Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
QuackMod.exe

Overview

General Information

Sample name:QuackMod.exe
Analysis ID:1374139
MD5:8402c65c2f1aeb6e797911f653e6b7e0
SHA1:5c0ceb1c1e146a121b958d71456327fe09175f5c
SHA256:ec4974127461dd4b05a83dea46e3f5c28620b3ff2a35189f3441a62c0b3e8efa
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • QuackMod.exe (PID: 1080 cmdline: C:\Users\user\Desktop\QuackMod.exe MD5: 8402C65C2F1AEB6E797911F653E6B7E0)
    • QuackMod.exe (PID: 5312 cmdline: C:\Users\user\Desktop\QuackMod.exe MD5: 8402C65C2F1AEB6E797911F653E6B7E0)
      • cmd.exe (PID: 5348 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 6568 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: QuackMod.exeReversingLabs: Detection: 37%
Source: QuackMod.exeVirustotal: Detection: 37%Perma Link
Source: QuackMod.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306513959.00007FF8B8793000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: QuackMod.exe, 00000002.00000002.3301265232.00007FF8A8100000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: QuackMod.exe, 00000002.00000002.3307999497.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306360170.00007FF8B8257000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: QuackMod.exe, 00000002.00000002.3305535052.00007FF8A9355000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: QuackMod.exe, 00000002.00000002.3302097151.00007FF8A84B2000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3307103649.00007FF8B8F8C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306958045.00007FF8B8CB2000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: QuackMod.exe, 00000002.00000002.3302097151.00007FF8A84B2000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306666091.00007FF8B8833000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3307103649.00007FF8B8F8C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3307523965.00007FF8B93CD000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: QuackMod.exe, 00000000.00000003.2039260925.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3308202054.00007FF8BA253000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306813558.00007FF8B8AF8000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: QuackMod.exe, 00000000.00000003.2039260925.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3308202054.00007FF8BA253000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306208558.00007FF8B80A8000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdb source: QuackMod.exe, 00000002.00000002.3305535052.00007FF8A9355000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: QuackMod.exe, 00000002.00000002.3303363758.00007FF8A8CDF000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: QuackMod.exe, 00000002.00000002.3305899238.00007FF8B807D000.00000002.00000001.01000000.00000013.sdmp
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6388D0 FindFirstFileExW,FindClose,0_2_00007FF77F6388D0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F647E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF77F647E4C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F647E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF77F647E4C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F651EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF77F651EE4
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI10802\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownDNS traffic detected: queries for: upgradeapi.PySimpleGUI.com
Source: QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
Source: QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: QuackMod.exe, 00000002.00000002.3300236863.000002442D5B4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/34568298/901641
Source: QuackMod.exe, 00000002.00000002.3297146336.000002442BC20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tip.tcl.tk/48)
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2044842513.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BA5000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2043371348.000002AE71BAB000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: QuackMod.exe, 00000002.00000002.3297404704.000002442BF12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://Demos.PySimpleGUI.org
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://Demos.PySimpleGUI.org)
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://Issues.PySimpleGUI.org
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://Issues.PySimpleGUI.org)
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://Issues.PySimpleGUI.org0b
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#button-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#button-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#buttonmenu-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#buttonmenu-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#canvas-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#canvas-elementrs
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#checkbox-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#checkbox-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#column-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#column-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#combo-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#combo-elementrz
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#frame-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#frame-elementrC
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#graph-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#graph-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#horizontalseparator-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#horizontalseparator-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#image-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#image-elementrV
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#input-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#input-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#listbox-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#listbox-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#menu-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#menu-elementr6
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#menubarcustom-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#menubarcustom-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#multiline-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#multiline-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#optionmenu-element
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#optionmenu-elementr
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#output-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#pane-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#progressbar-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#radio-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#slider-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#spin-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#statusbar-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#tab-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#tabgroup-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#table-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#text-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#titlebar-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#tree-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#verticalseparator-element
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://PySimpleGUI.org/en/latest/call%20reference/#window
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://Upgrading.PySimpleGUI.org
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://Upgrading.PySimpleGUI.org)
Source: QuackMod.exe, 00000000.00000003.2049342007.000002AE71BA1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C42A000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/%d.%d/libraryNrq
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/%d.%d/libraryNrqc
Source: QuackMod.exe, 00000002.00000002.3300236863.000002442D5C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C42A000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C47F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: QuackMod.exe, 00000002.00000002.3300236863.000002442D5C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/libraryath__
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C47F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C4F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/X.Y/library/
Source: QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/PySimpleGUI/PySimpleGUI
Source: QuackMod.exe, 00000002.00000002.3297146336.000002442BC10000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119895593.000002442BC19000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119659168.000002442BC15000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: QuackMod.exe, 00000002.00000002.3300236863.000002442D5B4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/michaelgundlach/mp3play
Source: QuackMod.exe, 00000002.00000002.3296920658.000002442B858000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: QuackMod.exe, 00000002.00000002.3297146336.000002442BC10000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119895593.000002442BC19000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119659168.000002442BC15000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: QuackMod.exe, 00000002.00000003.2125326955.000002442BE6D000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125088364.000002442BEF4000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2124957557.000002442BEDA000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125171006.000002442BF0B000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127537410.000002442BE62000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2126538315.000002442BE6D000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125236050.000002442BEED000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125131780.000002442BEDF000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3297404704.000002442BE42000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2126867039.000002442BE6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: QuackMod.exe, 00000002.00000002.3297146336.000002442BC10000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119895593.000002442BC19000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119659168.000002442BC15000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: QuackMod.exe, 00000002.00000002.3300236863.000002442D648000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gstreamer.freedesktop.org/documentation/tutorials/playback/playbin-usage.html
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C42A000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3297912284.000002442C331000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C48D000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C4F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: QuackMod.exe, 00000002.00000002.3299021749.000002442CD70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-%04d/
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-%04d/rp
Source: QuackMod.exe, 00000002.00000002.3297721971.000002442C010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
Source: QuackMod.exe, 00000002.00000002.3303363758.00007FF8A8CDF000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.drString found in binary or memory: https://peps.python.org/pep-0263/
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/PySimpleGUI/PySimpleGUI/master/
Source: QuackMod.exe, 00000002.00000003.2126800068.000002442BE30000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3297818461.000002442C110000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298873234.000002442CC1C000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2126505708.000002442BE29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/a/36221216)
Source: QuackMod.exe, 00000002.00000002.3299199387.000002442CE17000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.apple.com/en-us/HT201236
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.buymeacoffee.com/PySimpleGUI
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3305692418.00007FF8A9390000.00000002.00000001.01000000.00000014.sdmp, QuackMod.exe, 00000002.00000002.3302433035.00007FF8A85F3000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: https://www.openssl.org/H
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.paypal.me/pythongui
Source: QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.paypal.me/pythonguir
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C48D000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C4F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: QuackMod.exe, 00000002.00000002.3296920658.000002442B7D0000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2121487113.000002442BC50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: QuackMod.exe, 00000002.00000002.3303650413.00007FF8A8D7D000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.drString found in binary or memory: https://www.python.org/psf/license/
Source: QuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3299021749.000002442CD70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc%d.txt
Source: QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.udemy.com/course/pysimplegui/?couponCode=9AF99B123C49D51EB547
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8832AD0 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,2_2_00007FF8A8832AD0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8832AD0 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,2_2_00007FF8A8832AD0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87E8C00 GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,2_2_00007FF8A87E8C00
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87E8DD0 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,2_2_00007FF8A87E8DD0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F650F380_2_00007FF77F650F38
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6563700_2_00007FF77F656370
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6572BC0_2_00007FF77F6572BC
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6379500_2_00007FF77F637950
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6418800_2_00007FF77F641880
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F64E01C0_2_00007FF77F64E01C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6420A00_2_00007FF77F6420A0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F647E4C0_2_00007FF77F647E4C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F631F500_2_00007FF77F631F50
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F645F300_2_00007FF77F645F30
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F65471C0_2_00007FF77F65471C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F659FF80_2_00007FF77F659FF8
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F638FD00_2_00007FF77F638FD0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F641E940_2_00007FF77F641E94
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F647E4C0_2_00007FF77F647E4C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F651EE40_2_00007FF77F651EE4
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6436E00_2_00007FF77F6436E0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6486D00_2_00007FF77F6486D0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F656D700_2_00007FF77F656D70
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F642D500_2_00007FF77F642D50
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6565EC0_2_00007FF77F6565EC
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F641C900_2_00007FF77F641C90
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F64A4300_2_00007FF77F64A430
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F64E4B00_2_00007FF77F64E4B0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F647C980_2_00007FF77F647C98
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F64EB300_2_00007FF77F64EB30
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F650F380_2_00007FF77F650F38
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6542800_2_00007FF77F654280
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F641A840_2_00007FF77F641A84
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F643AE40_2_00007FF77F643AE4
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6422A40_2_00007FF77F6422A4
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A7FF18A02_2_00007FF8A7FF18A0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86C62702_2_00007FF8A86C6270
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86833102_2_00007FF8A8683310
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8624C272_2_00007FF8A8624C27
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8692D102_2_00007FF8A8692D10
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86825102_2_00007FF8A8682510
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A870CDF02_2_00007FF8A870CDF0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8779E902_2_00007FF8A8779E90
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A869A0C02_2_00007FF8A869A0C0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86289702_2_00007FF8A8628970
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86A19302_2_00007FF8A86A1930
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A875B1D02_2_00007FF8A875B1D0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86110FE2_2_00007FF8A86110FE
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A863E9E02_2_00007FF8A863E9E0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86311D02_2_00007FF8A86311D0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86851D02_2_00007FF8A86851D0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86B29802_2_00007FF8A86B2980
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86B42502_2_00007FF8A86B4250
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A870AAA02_2_00007FF8A870AAA0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A873C2B02_2_00007FF8A873C2B0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A873F2E02_2_00007FF8A873F2E0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86CB2C02_2_00007FF8A86CB2C0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86E8AA02_2_00007FF8A86E8AA0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A876CB802_2_00007FF8A876CB80
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8636B402_2_00007FF8A8636B40
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8720BC02_2_00007FF8A8720BC0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86663002_2_00007FF8A8666300
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86413F02_2_00007FF8A86413F0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8622BD02_2_00007FF8A8622BD0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8736B202_2_00007FF8A8736B20
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A873BB502_2_00007FF8A873BB50
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A861F4702_2_00007FF8A861F470
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8757C802_2_00007FF8A8757C80
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8625C212_2_00007FF8A8625C21
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8735CF02_2_00007FF8A8735CF0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A863F4002_2_00007FF8A863F400
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8708C002_2_00007FF8A8708C00
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A869DD502_2_00007FF8A869DD50
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A869ED402_2_00007FF8A869ED40
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8634D402_2_00007FF8A8634D40
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86E0DA02_2_00007FF8A86E0DA0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8629DA02_2_00007FF8A8629DA0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A863DDA02_2_00007FF8A863DDA0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86406002_2_00007FF8A8640600
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86D5F602_2_00007FF8A86D5F60
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A872F7902_2_00007FF8A872F790
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86137292_2_00007FF8A8613729
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87137F02_2_00007FF8A87137F0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A872DFF02_2_00007FF8A872DFF0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A875D7002_2_00007FF8A875D700
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86A27D02_2_00007FF8A86A27D0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A875BF302_2_00007FF8A875BF30
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8684FC02_2_00007FF8A8684FC0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87318902_2_00007FF8A8731890
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86888202_2_00007FF8A8688820
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86280202_2_00007FF8A8628020
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86CD0F02_2_00007FF8A86CD0F0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86D40C02_2_00007FF8A86D40C0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87470702_2_00007FF8A8747070
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88610E02_2_00007FF8A88610E0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88C85702_2_00007FF8A88C8570
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88607402_2_00007FF8A8860740
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88028B02_2_00007FF8A88028B0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88140602_2_00007FF8A8814060
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88B91F02_2_00007FF8A88B91F0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87F53802_2_00007FF8A87F5380
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87F14702_2_00007FF8A87F1470
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88B75AE2_2_00007FF8A88B75AE
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A881A9F02_2_00007FF8A881A9F0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87E6A202_2_00007FF8A87E6A20
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87ECA302_2_00007FF8A87ECA30
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8894A602_2_00007FF8A8894A60
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A888EB802_2_00007FF8A888EB80
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8890B402_2_00007FF8A8890B40
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A889CB402_2_00007FF8A889CB40
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87F0CB02_2_00007FF8A87F0CB0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8892CF02_2_00007FF8A8892CF0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88ACCF02_2_00007FF8A88ACCF0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87F2C002_2_00007FF8A87F2C00
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87EAC502_2_00007FF8A87EAC50
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A889ADD02_2_00007FF8A889ADD0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A886AD102_2_00007FF8A886AD10
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8870D302_2_00007FF8A8870D30
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A888CD502_2_00007FF8A888CD50
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87F8D402_2_00007FF8A87F8D40
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A889CEB02_2_00007FF8A889CEB0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8824EA02_2_00007FF8A8824EA0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87E4EE02_2_00007FF8A87E4EE0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88C8E002_2_00007FF8A88C8E00
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8816F102_2_00007FF8A8816F10
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88C70F02_2_00007FF8A88C70F0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87E10E02_2_00007FF8A87E10E0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88650202_2_00007FF8A8865020
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88DB0502_2_00007FF8A88DB050
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88501F02_2_00007FF8A88501F0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A889E1002_2_00007FF8A889E100
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88841402_2_00007FF8A8884140
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87F62B02_2_00007FF8A87F62B0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A885A2A02_2_00007FF8A885A2A0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: String function: 00007FF8A871B210 appears 67 times
Source: C:\Users\user\Desktop\QuackMod.exeCode function: String function: 00007FF8A8708BD0 appears 1073 times
Source: C:\Users\user\Desktop\QuackMod.exeCode function: String function: 00007FF8A8722D10 appears 128 times
Source: C:\Users\user\Desktop\QuackMod.exeCode function: String function: 00007FF77F632B30 appears 47 times
Source: QuackMod.exeBinary or memory string: OriginalFilename vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_tkinter.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2039601585.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2039260925.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2048228219.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenametcl86.dllP vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2039804509.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2041044042.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs QuackMod.exe
Source: QuackMod.exeBinary or memory string: OriginalFilename vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3306576565.00007FF8B8796000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3306088640.00007FF8B8099000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3307013504.00007FF8B8CB4000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3307194030.00007FF8B8F95000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3301531430.00007FF8A8105000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3306723100.00007FF8B8836000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3305692418.00007FF8A9390000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilenamelibsslH vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3296558004.0000024429FF6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilenametk86.dllP vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3307595917.00007FF8B93D2000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3305322306.00007FF8A8F1D000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython311.dll. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3306269580.00007FF8B80B2000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenametcl86.dllP vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3302433035.00007FF8A85F3000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3308266284.00007FF8BA259000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3306423606.00007FF8B825E000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3308068399.00007FF8B9F7D000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs QuackMod.exe
Source: QuackMod.exe, 00000002.00000002.3306872365.00007FF8B8AFE000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_tkinter.pyd. vs QuackMod.exe
Source: C:\Users\user\Desktop\QuackMod.exeSection loaded: python3.dllJump to behavior
Source: classification engineClassification label: mal48.winEXE@9/945@1/1
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F638560 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF77F638560
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A87EA2A0 GetModuleHandleW,GetProcAddress,CoInitialize,CoCreateInstance,CoCreateInstance,2_2_00007FF8A87EA2A0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5580:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2616:120:WilError_03
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802Jump to behavior
Source: QuackMod.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\QuackMod.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: QuackMod.exeReversingLabs: Detection: 37%
Source: QuackMod.exeVirustotal: Detection: 37%
Source: QuackMod.exeString found in binary or memory: -startline must be less than or equal to -endline
Source: QuackMod.exeString found in binary or memory: -help
Source: C:\Users\user\Desktop\QuackMod.exeFile read: C:\Users\user\Desktop\QuackMod.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\QuackMod.exe C:\Users\user\Desktop\QuackMod.exe
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Users\user\Desktop\QuackMod.exe C:\Users\user\Desktop\QuackMod.exe
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Users\user\Desktop\QuackMod.exe C:\Users\user\Desktop\QuackMod.exeJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: QuackMod.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: QuackMod.exeStatic file information: File size 12093721 > 1048576
Source: QuackMod.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: QuackMod.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: QuackMod.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: QuackMod.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: QuackMod.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: QuackMod.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: QuackMod.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: QuackMod.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: QuackMod.exe, 00000000.00000003.2047837597.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306513959.00007FF8B8793000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: QuackMod.exe, 00000002.00000002.3301265232.00007FF8A8100000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: QuackMod.exe, 00000002.00000002.3307999497.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: QuackMod.exe, 00000000.00000003.2040022821.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306360170.00007FF8B8257000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: QuackMod.exe, 00000002.00000002.3305535052.00007FF8A9355000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: QuackMod.exe, 00000002.00000002.3302097151.00007FF8A84B2000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3307103649.00007FF8B8F8C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: QuackMod.exe, 00000000.00000003.2041357270.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306958045.00007FF8B8CB2000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: QuackMod.exe, 00000002.00000002.3302097151.00007FF8A84B2000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: QuackMod.exe, 00000000.00000003.2040759882.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306666091.00007FF8B8833000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: QuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3307103649.00007FF8B8F8C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: QuackMod.exe, 00000000.00000003.2039446186.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3307523965.00007FF8B93CD000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: QuackMod.exe, 00000000.00000003.2039260925.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3308202054.00007FF8BA253000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: QuackMod.exe, 00000000.00000003.2041231010.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306813558.00007FF8B8AF8000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: QuackMod.exe, 00000000.00000003.2039260925.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3308202054.00007FF8BA253000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: QuackMod.exe, 00000000.00000003.2040889492.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3306208558.00007FF8B80A8000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdb source: QuackMod.exe, 00000002.00000002.3305535052.00007FF8A9355000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: QuackMod.exe, 00000002.00000002.3303363758.00007FF8A8CDF000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: QuackMod.exe, 00000002.00000002.3305899238.00007FF8B807D000.00000002.00000001.01000000.00000013.sdmp
Source: QuackMod.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: QuackMod.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: QuackMod.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: QuackMod.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: QuackMod.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A886AD10 abort,strcmp,strcmp,GetModuleHandleW,GetModuleFileNameW,LoadLibraryW,GetProcAddress,strncmp,2_2_00007FF8A886AD10
Source: QuackMod.exeStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F675004 push rsp; retf 0_2_00007FF77F675005
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A86435AA push rsp; retf 2_2_00007FF8A86435AB
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_tkinter.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\libssl-3.dllJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\select.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl86t.dllJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\libffi-8.dllJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\tk86t.dllJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI10802\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A8804370 IsIconic,IsZoomed,AdjustWindowRectEx,SendMessageW,SendMessageW,GetSystemMetrics,MoveWindow,GetWindowRect,GetClientRect,MoveWindow,GetWindowRect,MoveWindow,DrawMenuBar,2_2_00007FF8A8804370
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F636EF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF77F636EF0
Source: C:\Users\user\Desktop\QuackMod.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI10802\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\QuackMod.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17192
Source: C:\Users\user\Desktop\QuackMod.exeAPI coverage: 8.3 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F6388D0 FindFirstFileExW,FindClose,0_2_00007FF77F6388D0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F647E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF77F647E4C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F647E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF77F647E4C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F651EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF77F651EE4
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A876BF30 GetModuleHandleW,GetProcAddress,GetVersionExW,GetSystemInfo,wsprintfA,memcpy,2_2_00007FF8A876BF30
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI10802\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: QuackMod.exe, 00000002.00000002.3297912284.000002442C275000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWD
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F63C57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF77F63C57C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A886AD10 abort,strcmp,strcmp,GetModuleHandleW,GetModuleFileNameW,LoadLibraryW,GetProcAddress,strncmp,2_2_00007FF8A886AD10
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F653AF0 GetProcessHeap,0_2_00007FF77F653AF0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F63C760 SetUnhandledExceptionFilter,0_2_00007FF77F63C760
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F63C57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF77F63C57C
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F63BCE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF77F63BCE0
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F64ABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF77F64ABD8
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A7FF3058 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF8A7FF3058
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A7FF2A90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF8A7FF2A90
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A877AE20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF8A877AE20
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A88E01DC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF8A88E01DC
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Users\user\Desktop\QuackMod.exe C:\Users\user\Desktop\QuackMod.exeJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F659E40 cpuid 0_2_00007FF77F659E40
Source: C:\Users\user\Desktop\QuackMod.exeCode function: InitCommonControlsEx,RegisterClassW,GetKeyboardLayout,GetLocaleInfoW,TranslateCharsetInfo,2_2_00007FF8A88069C0
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8\8.4 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8\8.5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\http1.0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\opt0.4 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\duck.ico VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\libcrypto-3.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\libffi-8.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\libssl-3.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\python311.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\quack.wav VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\save.dat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl86t.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk86t.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\unicodedata.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\VCRUNTIME140.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_decimal.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_ssl.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_tkinter.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_uuid.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_tkinter.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_uuid.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\init.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\_ssl.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\unicodedata.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\Desktop\QuackMod.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\init.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\auto.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\tk.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tm.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8\8.5\msgcat-1.6.1.tm VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\package.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\pkgIndex.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\http1.0\pkgIndex.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\opt0.4\pkgIndex.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\icons.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\button.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\entry.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\listbox.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\menu.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\panedwindow.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\scale.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\scrlbar.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\spinbox.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\text.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\ttk.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\fonts.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\cursors.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\utils.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\button.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\menubutton.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\scrollbar.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\scale.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\progress.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\notebook.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\panedwindow.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\entry.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\combobox.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\spinbox.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\treeview.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\sizegrip.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\defaults.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\classicTheme.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\altTheme.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\clamTheme.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\winTheme.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\xpTheme.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\vistaTheme.tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F63C460 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF77F63C460
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A876BE40 GetUserNameW,2_2_00007FF8A876BE40
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 0_2_00007FF77F656370 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF77F656370
Source: C:\Users\user\Desktop\QuackMod.exeCode function: 2_2_00007FF8A876BF30 GetModuleHandleW,GetProcAddress,GetVersionExW,GetSystemInfo,wsprintfA,memcpy,2_2_00007FF8A876BF30

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
Valid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		11
Process Injection		11
Process Injection		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		Exfiltration Over Other Network Medium1
Encrypted Channel		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
Default Accounts2
Native API		Boot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory21
Security Software Discovery		Remote Desktop Protocol2
Clipboard Data		Exfiltration Over Bluetooth1
Non-Application Layer Protocol		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
Domain AccountsAtLogon Script (Windows)Logon Script (Windows)2
Obfuscated Files or Information		Security Account Manager1
Application Window Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
Application Layer Protocol		Data Encrypted for ImpactDNS ServerEmail Addresses
Local AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDS1
Account Discovery		Distributed Component Object ModelInput CaptureTraffic DuplicationProtocol ImpersonationData DestructionVirtual Private ServerEmployee Names
Cloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
System Owner/User Discovery		SSHKeyloggingScheduled TransferFallback ChannelsData Encrypted for ImpactServerGather Victim Network Information
Replication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureData Transfer Size LimitsMultiband CommunicationService StopBotnetDomain Properties
External Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync34
System Information Discovery		Windows Remote ManagementWeb Portal CaptureExfiltration Over C2 ChannelCommonly Used PortInhibit System RecoveryWeb ServicesDNS

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1374139 Sample: QuackMod.exe Startdate: 13/01/2024 Architecture: WINDOWS Score: 48 22 upgradeapi.PySimpleGUI.com 2->22 26 Multi AV Scanner detection for submitted file 2->26 9 QuackMod.exe 501 2->9         started        signatures3 process4 process5 11 QuackMod.exe 9->11         started        dnsIp6 24 upgradeapi.PySimpleGUI.com 143.42.125.232, 49704, 5353 PANDGUS United States 11->24 14 cmd.exe 1 11->14         started        16 cmd.exe 11->16         started        process7 process8 18 conhost.exe 14->18         started        20 conhost.exe 16->20         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
QuackMod.exe38%ReversingLabsWin64.Trojan.Generic
QuackMod.exe38%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
upgradeapi.PySimpleGUI.com0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#radio-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#button-elementr0%Avira URL Cloudsafe
https://Issues.PySimpleGUI.org0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#radio-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#spin-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#button-elementr0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#spin-element0%Avira URL Cloudsafe
https://Issues.PySimpleGUI.org0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#checkbox-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#checkbox-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#progressbar-element0%Avira URL Cloudsafe
https://Issues.PySimpleGUI.org0b0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#combo-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#tree-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#frame-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#checkbox-elementr0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#checkbox-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#tabgroup-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#verticalseparator-element0%Avira URL Cloudsafe
https://raw.githubusercontent.com/PySimpleGUI/PySimpleGUI/master/0%Avira URL Cloudsafe
https://Issues.PySimpleGUI.org)0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#combo-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#progressbar-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#menubarcustom-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#tabgroup-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#verticalseparator-element0%VirustotalBrowse
https://Demos.PySimpleGUI.org0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#listbox-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#tree-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#statusbar-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#menubarcustom-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#multiline-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#pane-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#frame-element0%VirustotalBrowse
https://raw.githubusercontent.com/PySimpleGUI/PySimpleGUI/master/1%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#menu-elementr60%Avira URL Cloudsafe
http://cacerts.digicert.co0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#listbox-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#multiline-elementr0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#listbox-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#tab-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#statusbar-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#menu-elementr60%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#table-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#image-element0%Avira URL Cloudsafe
http://cacerts.digicert.co0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#combo-elementrz0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#listbox-elementr0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#table-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#slider-element0%Avira URL Cloudsafe
http://cacerts.digi0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#pane-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#button-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#horizontalseparator-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#slider-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#tab-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#input-element0%Avira URL Cloudsafe
https://Demos.PySimpleGUI.org0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#horizontalseparator-elementr0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#multiline-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#image-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#combo-elementrz0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#menubarcustom-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#multiline-element0%VirustotalBrowse
https://Upgrading.PySimpleGUI.org)0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#buttonmenu-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#frame-elementrC0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#window0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#input-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#menu-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#menubarcustom-elementr0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#frame-elementrC0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#canvas-elementrs0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#image-elementrV0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#window0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#button-element0%VirustotalBrowse
https://PySimpleGUI.org/en/latest/call%20reference/#optionmenu-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#text-element0%Avira URL Cloudsafe
https://Upgrading.PySimpleGUI.org0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#input-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#graph-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#canvas-element0%Avira URL Cloudsafe
https://Demos.PySimpleGUI.org)0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#horizontalseparator-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#column-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#output-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#column-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#titlebar-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#optionmenu-element0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#buttonmenu-elementr0%Avira URL Cloudsafe
https://PySimpleGUI.org/en/latest/call%20reference/#graph-element0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
upgradeapi.PySimpleGUI.com
143.42.125.232
truefalseunknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://Issues.PySimpleGUI.orgQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://PySimpleGUI.org/en/latest/call%20reference/#button-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://mahler:8092/site-updates.pyQuackMod.exe, 00000002.00000002.3298237748.000002442C48D000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C4F7000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
low
https://PySimpleGUI.org/en/latest/call%20reference/#radio-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://docs.python.org/3.11/libraryath__QuackMod.exe, 00000002.00000002.3300236863.000002442D5C0000.00000004.00001000.00020000.00000000.sdmpfalse
    		high
    https://PySimpleGUI.org/en/latest/call%20reference/#spin-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
    • 0%, Virustotal, Browse
    • Avira URL Cloud: safe
    		unknown
    https://PySimpleGUI.org/en/latest/call%20reference/#checkbox-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
    • 0%, Virustotal, Browse
    • Avira URL Cloud: safe
    		unknown
    https://www.python.org/download/releases/2.3/mro/.QuackMod.exe, 00000002.00000002.3296920658.000002442B7D0000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2121487113.000002442BC50000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      https://PySimpleGUI.org/en/latest/call%20reference/#checkbox-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      https://PySimpleGUI.org/en/latest/call%20reference/#progressbar-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      https://Issues.PySimpleGUI.org0bQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://PySimpleGUI.org/en/latest/call%20reference/#tree-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      https://PySimpleGUI.org/en/latest/call%20reference/#combo-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      https://PySimpleGUI.org/en/latest/call%20reference/#frame-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      https://PySimpleGUI.org/en/latest/call%20reference/#tabgroup-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      https://PySimpleGUI.org/en/latest/call%20reference/#verticalseparator-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/%d.%d/libraryNrqcQuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#QuackMod.exe, 00000002.00000002.3297146336.000002442BC10000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119895593.000002442BC19000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119659168.000002442BC15000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          https://raw.githubusercontent.com/PySimpleGUI/PySimpleGUI/master/QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
          • 1%, Virustotal, Browse
          • Avira URL Cloud: safe
          		unknown
          https://www.paypal.me/pythonguiQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://Issues.PySimpleGUI.org)QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		low
            https://PySimpleGUI.org/en/latest/call%20reference/#menubarcustom-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://Demos.PySimpleGUI.orgQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://PySimpleGUI.org/en/latest/call%20reference/#listbox-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://PySimpleGUI.org/en/latest/call%20reference/#statusbar-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64QuackMod.exe, 00000002.00000002.3298237748.000002442C42A000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C47F000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://www.udemy.com/course/pysimplegui/?couponCode=9AF99B123C49D51EB547QuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://tip.tcl.tk/48)QuackMod.exe, 00000002.00000002.3297146336.000002442BC20000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6QuackMod.exe, 00000002.00000002.3297404704.000002442BF12000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://PySimpleGUI.org/en/latest/call%20reference/#multiline-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://PySimpleGUI.org/en/latest/call%20reference/#pane-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://PySimpleGUI.org/en/latest/call%20reference/#menu-elementr6QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    http://cacerts.digicert.coQuackMod.exe, 00000000.00000003.2040326447.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://PySimpleGUI.org/en/latest/call%20reference/#listbox-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://PySimpleGUI.org/en/latest/call%20reference/#tab-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://PySimpleGUI.org/en/latest/call%20reference/#table-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://PySimpleGUI.org/en/latest/call%20reference/#image-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://docs.python.org/X.Y/library/QuackMod.exe, 00000002.00000002.3298237748.000002442C47F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C4F7000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://PySimpleGUI.org/en/latest/call%20reference/#combo-elementrzQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      https://docs.python.org/QuackMod.exe, 00000002.00000002.3298237748.000002442C42A000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://PySimpleGUI.org/en/latest/call%20reference/#slider-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                        • 0%, Virustotal, Browse
                        • Avira URL Cloud: safe
                        		unknown
                        http://cacerts.digiQuackMod.exe, 00000000.00000003.2046135056.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://PySimpleGUI.org/en/latest/call%20reference/#button-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                        • 0%, Virustotal, Browse
                        • Avira URL Cloud: safe
                        		unknown
                        https://PySimpleGUI.org/en/latest/call%20reference/#horizontalseparator-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                        • 0%, Virustotal, Browse
                        • Avira URL Cloud: safe
                        		unknown
                        http://stackoverflow.com/a/34568298/901641QuackMod.exe, 00000002.00000002.3300236863.000002442D5B4000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://peps.python.org/pep-0205/QuackMod.exe, 00000002.00000002.3297721971.000002442C010000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://PySimpleGUI.org/en/latest/call%20reference/#input-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                            • 0%, Virustotal, Browse
                            • Avira URL Cloud: safe
                            		unknown
                            https://github.com/michaelgundlach/mp3playQuackMod.exe, 00000002.00000002.3300236863.000002442D5B4000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://PySimpleGUI.org/en/latest/call%20reference/#multiline-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                              • 0%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://Upgrading.PySimpleGUI.org)QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688QuackMod.exe, 00000002.00000002.3296920658.000002442B858000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://PySimpleGUI.org/en/latest/call%20reference/#menubarcustom-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                		unknown
                                https://github.com/PySimpleGUI/PySimpleGUIQuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ConnectionQuackMod.exe, 00000000.00000003.2049342007.000002AE71BA1000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://www.paypal.me/pythonguirQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://PySimpleGUI.org/en/latest/call%20reference/#buttonmenu-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://PySimpleGUI.org/en/latest/call%20reference/#frame-elementrCQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • 0%, Virustotal, Browse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://PySimpleGUI.org/en/latest/call%20reference/#windowQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • 0%, Virustotal, Browse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://docs.python.org/%d.%d/libraryNrqQuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.python.org/QuackMod.exe, 00000002.00000002.3298237748.000002442C48D000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298237748.000002442C4F7000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerQuackMod.exe, 00000002.00000002.3297146336.000002442BC10000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119895593.000002442BC19000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119659168.000002442BC15000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/python/cpython/issues/86361.QuackMod.exe, 00000002.00000003.2125326955.000002442BE6D000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125088364.000002442BEF4000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2124957557.000002442BEDA000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125171006.000002442BF0B000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127537410.000002442BE62000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2126538315.000002442BE6D000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125236050.000002442BEED000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125131780.000002442BEDF000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3297404704.000002442BE42000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2126867039.000002442BE6D000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://json.orgQuackMod.exe, 00000002.00000002.3298237748.000002442C42A000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3297912284.000002442C331000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.buymeacoffee.com/PySimpleGUIQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://PySimpleGUI.org/en/latest/call%20reference/#menu-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://PySimpleGUI.org/en/latest/call%20reference/#canvas-elementrsQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://PySimpleGUI.org/en/latest/call%20reference/#image-elementrVQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://PySimpleGUI.org/en/latest/call%20reference/#optionmenu-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://docs.python.org/3.11/libraryQuackMod.exe, 00000002.00000002.3300236863.000002442D5C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://PySimpleGUI.org/en/latest/call%20reference/#text-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://Upgrading.PySimpleGUI.orgQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://PySimpleGUI.org/en/latest/call%20reference/#input-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://peps.python.org/pep-%04d/rpQuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syQuackMod.exe, 00000002.00000002.3297146336.000002442BC10000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119895593.000002442BC19000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119659168.000002442BC15000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://PySimpleGUI.org/en/latest/call%20reference/#graph-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://www.python.org/psf/license/QuackMod.exe, 00000002.00000002.3303650413.00007FF8A8D7D000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.drfalse
                                                          		high
                                                          https://PySimpleGUI.org/en/latest/call%20reference/#canvas-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://Demos.PySimpleGUI.org)QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		low
                                                          https://PySimpleGUI.org/en/latest/call%20reference/#horizontalseparator-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://gstreamer.freedesktop.org/documentation/tutorials/playback/playbin-usage.htmlQuackMod.exe, 00000002.00000002.3300236863.000002442D648000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://PySimpleGUI.org/en/latest/call%20reference/#column-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://stackoverflow.com/a/36221216)QuackMod.exe, 00000002.00000003.2126800068.000002442BE30000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3297818461.000002442C110000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3298873234.000002442CC1C000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2126505708.000002442BE29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://PySimpleGUI.org/en/latest/call%20reference/#output-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://www.openssl.org/HQuackMod.exe, 00000000.00000003.2045077977.000002AE71B9F000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3305692418.00007FF8A9390000.00000002.00000001.01000000.00000014.sdmp, QuackMod.exe, 00000002.00000002.3302433035.00007FF8A85F3000.00000002.00000001.01000000.00000010.sdmpfalse
                                                                		high
                                                                https://PySimpleGUI.org/en/latest/call%20reference/#column-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://www.rfc-editor.org/rfc/rfc%d.txtQuackMod.exe, 00000002.00000002.3298237748.000002442C5A2000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000002.3299021749.000002442CD70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://PySimpleGUI.org/en/latest/call%20reference/#titlebar-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://PySimpleGUI.org/en/latest/call%20reference/#optionmenu-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://peps.python.org/pep-%04d/QuackMod.exe, 00000002.00000002.3299021749.000002442CD70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyQuackMod.exe, 00000002.00000003.2119633766.000002442BC1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://PySimpleGUI.org/en/latest/call%20reference/#buttonmenu-elementrQuackMod.exe, 00000002.00000003.2125894541.000002442C729000.00000004.00000020.00020000.00000000.sdmp, QuackMod.exe, 00000002.00000003.2127127858.000002442CB33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://PySimpleGUI.org/en/latest/call%20reference/#graph-elementQuackMod.exe, 00000002.00000002.3298684186.000002442C610000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://peps.python.org/pep-0263/QuackMod.exe, 00000002.00000002.3303363758.00007FF8A8CDF000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.drfalse
                                                                        		high

                                                                        World Map of Contacted IPs

                                                                        • No. of IPs < 25%
                                                                        • 25% < No. of IPs < 50%
                                                                        • 50% < No. of IPs < 75%
                                                                        • 75% < No. of IPs

                                                                        Public IPs

                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                        143.42.125.232
                                                                        		upgradeapi.PySimpleGUI.comUnited States
                                                                        		11003PANDGUSfalse

                                                                        General Information

                                                                        Joe Sandbox version:38.0.0 Ammolite
                                                                        Analysis ID:1374139
                                                                        Start date and time:2024-01-13 04:57:21 +01:00
                                                                        Joe Sandbox product:CloudBasic
                                                                        Overall analysis duration:0h 7m 53s
                                                                        Hypervisor based Inspection enabled:false
                                                                        Report type:full
                                                                        Cookbook file name:default.jbs
                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                        Number of analysed new started processes analysed:9
                                                                        Number of new started drivers analysed:0
                                                                        Number of existing processes analysed:0
                                                                        Number of existing drivers analysed:0
                                                                        Number of injected processes analysed:0
                                                                        Technologies:
                                                                        • HCA enabled
                                                                        • EGA enabled
                                                                        • AMSI enabled
                                                                        Analysis Mode:default
                                                                        Analysis stop reason:Timeout
                                                                        Sample name:QuackMod.exe
                                                                        Detection:MAL
                                                                        Classification:mal48.winEXE@9/945@1/1
                                                                        EGA Information:
                                                                        • Successful, ratio: 100%
                                                                        HCA Information:
                                                                        • Successful, ratio: 71%
                                                                        • Number of executed functions: 108
                                                                        • Number of non-executed functions: 158
                                                                        Cookbook Comments:
                                                                        • Found application associated with file extension: .exe

                                                                        Warnings

                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                        • Report size getting too big, too many NtWriteFile calls found.

                                                                        Simulations

                                                                        Behavior and APIs

                                                                        ⊘No simulations

                                                                        Joe Sandbox View / Context

                                                                        IPs

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        143.42.125.232baliksabit.exeGet hashmaliciousUnknownBrowse

                                                                          Domains

                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          upgradeapi.PySimpleGUI.combaliksabit.exeGet hashmaliciousUnknownBrowse
                                                                          • 143.42.125.232

                                                                          ASNs

                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          PANDGUSskyljne.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.38.163.146
                                                                          sk3v96prYe.elfGet hashmaliciousUnknownBrowse
                                                                          • 143.14.220.139
                                                                          TD1WokqMcd.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.13.230.221
                                                                          skyljne.x86.elfGet hashmaliciousMiraiBrowse
                                                                          • 151.222.212.214
                                                                          x86.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.10.100.83
                                                                          KddPKUnEY7.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.38.3.198
                                                                          6ifDTE2YrV.elfGet hashmaliciousMiraiBrowse
                                                                          • 137.182.252.82
                                                                          9BwUsuGgIa.elfGet hashmaliciousUnknownBrowse
                                                                          • 143.9.85.45
                                                                          1rPT05xWNh.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.18.160.125
                                                                          baliksabit.exeGet hashmaliciousUnknownBrowse
                                                                          • 143.42.125.232
                                                                          skyljne.arm.elfGet hashmaliciousMiraiBrowse
                                                                          • 151.222.124.246
                                                                          887OOdJ3rV.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.15.240.5
                                                                          b3astmode.arm.elfGet hashmaliciousMiraiBrowse
                                                                          • 155.117.211.20
                                                                          b3astmode.arm7.elfGet hashmaliciousMiraiBrowse
                                                                          • 155.117.211.20
                                                                          a3SIMycc8C.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.29.158.237
                                                                          t684cbmCtc.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.34.232.193
                                                                          6piQjotuYV.elfGet hashmaliciousMiraiBrowse
                                                                          • 151.208.73.197
                                                                          HzVSmFnQIA.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.37.78.189
                                                                          nig.arm7.elfGet hashmaliciousMiraiBrowse
                                                                          • 143.25.249.88
                                                                          mips-20231212-1320.elfGet hashmaliciousMiraiBrowse
                                                                          • 151.222.24.242

                                                                          JA3 Fingerprints

                                                                          ⊘No context

                                                                          Dropped Files

                                                                          ⊘No context

                                                                          Created / dropped Files

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\VCRUNTIME140.dll

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):119192
                                                                          Entropy (8bit):6.6016214745004635
                                                                          Encrypted:false
                                                                          SSDEEP:1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
                                                                          MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
                                                                          SHA1:A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
                                                                          SHA-256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
                                                                          SHA-512:0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_bz2.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):84760
                                                                          Entropy (8bit):6.5692755156011025
                                                                          Encrypted:false
                                                                          SSDEEP:1536:cfz7OThu5JLlHRGxlDAwGzzVXU8dhkb48UlIyCVJ7SyMxD:cfzSFlDlCHdhkmlIyCVJU
                                                                          MD5:AFAA11704FDA2ED686389080B6FFCB11
                                                                          SHA1:9A9C83546C2E3B3CCF823E944D5FD07D22318A1B
                                                                          SHA-256:AB34B804DA5B8E814B2178754D095A4E8AEAD77EEFD3668DA188769392CDB5F4
                                                                          SHA-512:DE23BB50F1D416CF4716A5D25FE12F4B66E6226BB39E964D0DE0FEF1724D35B48C681809589C731D3061A97C62B4DC7B9B7DFE2978F196F2D82CCCE286BE8A2A
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d....(ne.........." ...%.....^...............................................P.......i....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text...7........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_ctypes.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):124696
                                                                          Entropy (8bit):6.043702317006711
                                                                          Encrypted:false
                                                                          SSDEEP:3072:DJMe7jc823LQHUlYsNZfLIbKV6pJfJIyLPKZ:DWeoL0GNZfLIbCcJfi
                                                                          MD5:78DF76AA0FF8C17EDC60376724D206CD
                                                                          SHA1:9818BD514D3D0FC1749B2D5EF9E4D72D781B51DD
                                                                          SHA-256:B75560DB79BA6FB56C393A4886EEDD72E60DF1E2F7F870FE2E356D08155F367B
                                                                          SHA-512:6189C1BD56DB5B7A9806960BC27742D97D2794ACEBC32E0A5F634FE0FF863E1775DCF90224504D5E2920A1192A3C1511FB84D41D7A2B69C67D3BDFBAB2F968FA
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........X...X...X...Q.*.^...M...Z...M...T...M...P...M...\...b...Z.......Y.......^.......[...X.......b...^...b...Y...b.F.Y...b...Y...RichX...........PE..d....'ne.........." ...%.............\..............................................\.....`..........................................Q.......Q..................P......../..............T...........................`...@............................................text............................... ..`.rdata..2m.......n..................@..@.data...$=...p...8...`..............@....pdata..P...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_decimal.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):253720
                                                                          Entropy (8bit):6.556660448912721
                                                                          Encrypted:false
                                                                          SSDEEP:6144:JFrhZMm47r6aA2MQbPS4ELT4zH2n9qWM53pLW1A+tARs4:JFrhV4qaA2ffEozWa0ARD
                                                                          MD5:33F721F1CBB413CD4F26FE0ED4A597E7
                                                                          SHA1:476D5FAB7B2DB3F53B90B7CC6099D5541E72883E
                                                                          SHA-256:080D0FBBFF68D17B670110C95210347BE7B8AB7C385F956F123A66DC2F434AB3
                                                                          SHA-512:8FBC82AF0FE063C4EB8FDEFAE5650924AC607BE54B81C4D51064CA720BB85BFC9E1705BA93DF5BE6ADD156A6B360DD1F700618862877E28DE7C13E21B470B507
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d....'ne.........." ...%.x...<............................................................`..........................................T..P....T..................`'......./......P.......T...........................p...@............................................text...5w.......x.................. ..`.rdata...............|..............@..@.data....*...p...$...T..............@....pdata..`'.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_hashlib.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):65304
                                                                          Entropy (8bit):6.25487370026842
                                                                          Encrypted:false
                                                                          SSDEEP:1536:nuY1lTorKn+zF9G0pLOjWNBgdIyOI8f7SyxxUx:nuY+9GIOjiBgdIyOI8fY
                                                                          MD5:534902BE1D8A57974EFD025AFF4F11EF
                                                                          SHA1:1179C6153DC52F72C29FE1591DC9A889C2E229E9
                                                                          SHA-256:30ADFB86513282E59D7E27968E1FF6686E43B8559994A50C17BE66D0789F82B3
                                                                          SHA-512:7F0CDCF8576FAF30FC8104B9BC9586D85AD50B7803074A7BCAA192EED05B1E2BD988A91873554FB63F204FCAD86C667E95755C5FF13C43F96DC334EF3EA37240
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>@j.P.j.P.j.P.c...n.P...Q.h.P...U.f.P...T.b.P...S.i.P.PaQ.h.P.!.Q.h.P...Q.i.P.j.Q...P.Pa].k.P.PaP.k.P.Pa..k.P.PaR.k.P.Richj.P.........PE..d... (ne.........." ...%.T...~......0@..............................................a_....`.............................................P................................/......X...P}..T............................|..@............p..0............................text....S.......T.................. ..`.rdata..rO...p...P...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_lzma.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):159000
                                                                          Entropy (8bit):6.852849132106876
                                                                          Encrypted:false
                                                                          SSDEEP:3072:Bl2grSWcJSEoLSHK/znfU9mNo2s2AaK5VlIyZ1Zxzp:Blh2nJ9a8YO2u7rp
                                                                          MD5:2AE2464BFCC442083424BC05ED9BE7D2
                                                                          SHA1:F64B100B59713E51D90D2E016B1FE573B6507B5D
                                                                          SHA-256:64BA475A28781DCA81180A1B8722A81893704F8D8FAC0B022C846FDCF95B15B9
                                                                          SHA-512:6C3ACD3DCAE733452AD68477417693AF64A7D79558E8EC9F0581289903C2412E2F29195B90E396BFDCD765337A6DEA9632E4B8D936AC39B1351CD593CB12CE27
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH...)t..)t..)t..Q...)t..Vu..)t..Vq..)t..Vp..)t..Vw..)t.,.u..)t.]Qu..)t..)u.p)t.,.y.,)t.,.t..)t.,....)t.,.v..)t.Rich.)t.................PE..d...#(ne.........." ...%.b..........P6....................................................`..........................................%..L...L%..x....p.......P.......>.../......8.......T...........................p...@............................................text....a.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_queue.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):32536
                                                                          Entropy (8bit):6.445663619180805
                                                                          Encrypted:false
                                                                          SSDEEP:768:y+yFV6rXzmxU9JIyQUM5YiSyvKtp/AMxkEj:y+wEXzWU9JIyQU27Sy4xH
                                                                          MD5:DBD3C2C0A348A44A96D76100690C606D
                                                                          SHA1:04E901EAC1161255ADB16155459AC50F124B30A6
                                                                          SHA-256:2BFD8459BA01C741D676F79EE96802FB2C29CB30F50301D67FDE8BBCE8E7E7D4
                                                                          SHA-512:99FEE97C272BFFF4515407D588B2761AF7BE39A83BE070E01128FBA71FF75404FBAD6352BCDBE5465786CE86A6550F47B177D022CCB53F32F5A482DB61BEE3B4
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.X.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.TSa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.................PE..d....'ne.........." ...%.....8...........................................................`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_socket.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):79640
                                                                          Entropy (8bit):6.288109761411876
                                                                          Encrypted:false
                                                                          SSDEEP:1536:sRbflgPFXDclujZ9/s+S+pzpGkTFVf7KJIyLw57SyCxz7:sDm1EujZ9/sT+pz0KFVTKJIyLw567
                                                                          MD5:11B7936A5BD929CC76AC3F4F137B5236
                                                                          SHA1:09CB712FA43DC008EB5185481A5080997AFF82AB
                                                                          SHA-256:8956B11C07D08D289425E7240B8FA37841A27C435617DBBD02BFE3F9405F422B
                                                                          SHA-512:7B050DF283A0AD4295A5BE47B99D7361F49A3CFD20691E201C5DA5349A9EB8F5710AB3A26A66D194567539660ED227411485F4EDF2269567A55A6B8CCFD71096
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h...............q.......v.......v.......v.......v.......................q........................l.............Rich....................PE..d....(ne.........." ...%.l...........%.......................................P............`.............................................P............0....... ..x......../...@..........T...............................@............................................text....k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_ssl.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):176920
                                                                          Entropy (8bit):5.956358505915276
                                                                          Encrypted:false
                                                                          SSDEEP:3072:hjIQQj5DC1z/39/2uXU6XjXylB9d43Olh59YL48PMrN/WgAlNiVlIyC7WN:Kj5mRPxbU6XjK4TLiVL
                                                                          MD5:0E9E6D6839D74AD40BB9F16CC6601B13
                                                                          SHA1:6671039088793F4BA42F5BD4409C26B1283CEAFA
                                                                          SHA-256:BCA1F490C9F7BA25CBBB4B39785DDA8AA651123E22D4E7EDC299B218C8157A81
                                                                          SHA-512:CB8742AE5DB83487C21BA17D9EFACA736DF49F8F3C4A72355EDE119717B83E0B4C6D94BD1C75A992ABAF4AB89502A805F81B2529E85FD6A656600D6E7B0C90F5
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L..VL...L...M...L...M...L...M...L...M...L.f.M...Lc..M...L...L4..L..M...L.f.M...L.f.M...L.f:L...L.f.M...LRich...L........PE..d...#(ne.........." ...%............l+..............................................Y.....`.........................................0...d................................/......|...P...T...............................@............................................text.............................. ..`.rdata...".......$..................@..@.data...............................@....pdata...............\..............@..@.rsrc................h..............@..@.reloc..|............r..............@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_tkinter.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):64280
                                                                          Entropy (8bit):6.281804012649624
                                                                          Encrypted:false
                                                                          SSDEEP:1536:LyF7WUmDzDDnpuZB81CvguSKdIyOSR7SypxZ:LyLWYZBpvguSKdIyOSRv
                                                                          MD5:E3BFC9A6CBBEDE7CF69D4C14104BA270
                                                                          SHA1:78EE71C37E55479ED98150B0E1A8868562DE6582
                                                                          SHA-256:652645A21F6CDB07358B29B4535F8E978F445856AED995FBB9F741C871C62162
                                                                          SHA-512:D97594CA1B837FEAE94D3E7D046BA43D834B0A1703CEEB4C01BAA3C150AE31A879607E2C4BB0DAE11E0A1BB47060C96B283CC97C1CA1DA103ED2265D7AACD7A8
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.H.:|&.:|&.:|&.3...<|&./.'.8|&./.#.7|&./.".2|&./.%.9|&...'.8|&.q.'.8|&...'.?|&.:|'..|&...+.8|&...&.;|&....;|&...$.;|&.Rich:|&.........PE..d...%(ne.........." ...%.h...f............................................................`.............................................P.............................../......$......T...............................@............................................text..._f.......h.................. ..`.rdata...@.......B...l..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\_uuid.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):25368
                                                                          Entropy (8bit):6.632295020580043
                                                                          Encrypted:false
                                                                          SSDEEP:384:MfodpEWxfivQlIyZwFgHQIYiSy1pCQ3vIC2AM+o/8E9VF0NyUl:MKpE+4QlIyZwk5YiSyv3gdAMxkEM
                                                                          MD5:4BA1FCF5F12EBC514E86D7E02901B3C3
                                                                          SHA1:0FD88DF618DA41CDEB4AFDADED039932A66CE5F6
                                                                          SHA-256:51CB69267F77C094D687AF5B80C560EAF325D0990304BAF20242D477D8B156A1
                                                                          SHA-512:3601331A84A9DCF62BBDADFC5C273853ACF229931E70F5FF6F541D5F23474373F9366C606534FFDBF73C1044E98E464877B395F2E285821F264A57CD90021705
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........pjzz#jzz#jzz#c..#hzz#..{"hzz#..."fzz#..~"bzz#..y"izz#P.{"hzz#!.{"ozz#jz{#@zz#P.r"kzz#P.z"kzz#P..#kzz#P.x"kzz#Richjzz#........PE..d....'ne.........." ...%.....&...... ........................................p.......v....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\base_library.zip

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1442277
                                                                          Entropy (8bit):5.590680301756823
                                                                          Encrypted:false
                                                                          SSDEEP:24576:mQR5pATG8/R5lUKdcubgAnyfb6/X0iwhmdmzNPFa0HHp:mQR5pE/RJvG
                                                                          MD5:81CD6D012885629791A9E3D9320C444E
                                                                          SHA1:53268184FDBDDF8909C349ED3C6701ABE8884C31
                                                                          SHA-256:A18892E4F2F2EC0DEE5714429F73A5ADD4E355D10A7BA51593AFC730F77C51DD
                                                                          SHA-512:D5BF47FAD8B1F5C7DCAA6BEF5D4553E461F46E6C334B33D8ADC93689CF89365C318F03E961A5D33994730B72DC8BDE62209BACA015D0D2D08A081D82DF7DFD73
                                                                          Malicious:false
                                                                          Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\duck.ico

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):22424
                                                                          Entropy (8bit):7.976548812325941
                                                                          Encrypted:false
                                                                          SSDEEP:384:Z/k8UniipSmuPQa4Dav37YCsbFznoolzTpHH9+bFW5LaScQAYah:ZM8+9pSdYa4ZBFznxTpIRW5LaScQAF
                                                                          MD5:CCCCE13DFCFCB514853B2286106C9BE2
                                                                          SHA1:BE513BBA8A81DF138E67F078B54E592682BDFDDE
                                                                          SHA-256:44306F824AF31FFC013C95F2DEBD9B39D09FB10855BEAFE3A4AD2426735ECF8B
                                                                          SHA-512:6544B5725FD73A897FEA22D730B64C49FB91501F94933BB4AEF3A6B4080F91F74171035008A98D030E4634B4417E477D275D57EE6C73B49001B2511DA64E1D09
                                                                          Malicious:false
                                                                          Preview:............ ..W.......PNG........IHDR.............\r.f....orNT..w...W<IDATx..].x.U.E...H/$@.-.........#.RT.R.i".(..A."R...A.b...........d..}...L....)g..+f...._..+.%.a..$F5FCF;F7.p.D.}....g..........3..o0....g_`lcl`<.....q..1..#.Q....a\e.1.0....Uj.0.dF..@.8.\...-.....G....3>a|...q.q..=.......3.._..~....u.p..3.2.2.2.3.b.f.ad0......o.<........2|..F.Do.>.a..9..z..a.U........1~c..8...\..-....9~.....F./16.c.....C?F.F3F.:...?...4'.<.R(.5#.......1............a.Q.b<....)KmF,#.q.q..QX...........c.......[.|.6...3....:...:......U.Y9?.+.)2......-.T...4w~Es.O5..)G.~.............E.Z.x.1....(...q..Q ...l...}.w3V.......b#.s....2.k.0D...P/0'.<.....(..Q.GK.z.P.z..........NG...C.ja.>..t.A.:....`..e.Wj..ajK.o.Cknx...>R^.,.>.k.j.........B.~.V......g.....d..... .8.....j..1[I0......T..c.SrlqJ..;.o.o.,E.Pk+..x.Y....!......j..!G............$6....T=.$....z.}.Q-?jZ...........U...y..i. ?.........C5.K.....sxaj..73f0n`.e\k..y.b.%........].}^........K.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\libcrypto-3.dll

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5162776
                                                                          Entropy (8bit):5.958207976652471
                                                                          Encrypted:false
                                                                          SSDEEP:98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
                                                                          MD5:51E8A5281C2092E45D8C97FBDBF39560
                                                                          SHA1:C499C810ED83AAADCE3B267807E593EC6B121211
                                                                          SHA-256:2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
                                                                          SHA-512:98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\libffi-8.dll

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):39696
                                                                          Entropy (8bit):6.641880464695502
                                                                          Encrypted:false
                                                                          SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                          MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                          SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                          SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                          SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\libssl-3.dll

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):790296
                                                                          Entropy (8bit):5.607732992846443
                                                                          Encrypted:false
                                                                          SSDEEP:6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
                                                                          MD5:BFC834BB2310DDF01BE9AD9CFF7C2A41
                                                                          SHA1:FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
                                                                          SHA-256:41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
                                                                          SHA-512:6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\python311.dll

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5785880
                                                                          Entropy (8bit):6.090091140780886
                                                                          Encrypted:false
                                                                          SSDEEP:98304:0asy3088wAPo8yN4yl57G+160THIM1uFvvBnTfDyY:hsy3088wAPo8pyl57G81GrOY
                                                                          MD5:86E0AD6BA8A9052D1729DB2C015DAF1C
                                                                          SHA1:48112072903FFF2EC5726CCA19CC09E42D6384C7
                                                                          SHA-256:5ECDA62F6FD2822355C560412F6D90BE46A7F763F0FFEEC9854177904632AC2D
                                                                          SHA-512:5D6E32F9FF90A9A584183DAD1583AEA2327B4AEA32184B0EBBEC3DF41B0B833E6BB3CD40822DD64D1033125F52255812B17E4FA0ADD38FCDA6BAB1724DFAA2EB
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b..|...|...|.......|.......|.......|.......|.......|.......|......|...|..}.......|.......|.......|.......|..Rich.|..........................PE..d....'ne.........." ...%..%..L7......u.......................................0].....*.X...`...........................................@.......A.......[.......W..2....X../....[.tD....*.T.............................*.@.............%..............................text....%.......%................. ..`.rdata........%.......%.............@..@.data... #....A..T....A.............@....pdata...2....W..4....R.............@..@PyRuntim.....@Y......>T.............@....rsrc.........[.......V.............@..@.reloc..tD....[..F....V.............@..B........................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\quack.wav

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):29942
                                                                          Entropy (8bit):7.66807108364977
                                                                          Encrypted:false
                                                                          SSDEEP:768:D6v7U4SxYNmI3cMAJkWdLnejGJ35st9J3i7jfKhWhTgdCOIzZ:D/GNmuDAJxAA3GLsnKohhzZ
                                                                          MD5:922780398ABE544DE4FEDD6F6DF31950
                                                                          SHA1:096EB751D36E8F1265A124394B757F05605D7F62
                                                                          SHA-256:8A406675D027F8FE8601E9A67A34A41B261EFF87DEF7B258804E072EE1422333
                                                                          SHA-512:88A1B5F8533869C2ED60A19D6884B7AC95C2BD060E98BB058A3EAE5324317023C5E7B10C6C9D175DD3F849431B1B66608B2F725E50631BA8457457C828B3EDBC
                                                                          Malicious:false
                                                                          Preview:RIFF.t..WAVEfmt ........D...........LIST....INFOISFT....Lavf59.27.100.data.t..................................................................(.&.E.E.=.=.1.1.D.F.`.`.G.G.............6.6.T.S.<.<.&.(.E.F.x.x.v.v.<.;.........@.@.G.G.6.6./...A.A.W.Y.`.`.d.d.p.p.s.r.i.j.{.|.............s.s.............N.O.K.J.3.3.T.U.............R.Q.....!.!.7.7.5.5.*.+.=.=.f.f.{.{.].].............n.n.f.f.T.T.P.P.k.k.....b.d.....................F.G.P.O.B.C.,.-.).'.I.I.y.y.................;.;.....................x.y.............................%.&.c.b.........U.U.....r.r.8.7.....Z.[...............~.).).................z.y.>.>.................'.&.........o.m.8.9.........B.C.....J.I.................o.o.....a.`.5.7.............x.x.............................K.L.....@.@.....N.M.....................G.F........./.-........./..._.`.....F.E.....6.6.........).(.m.l.s.t.t.t.v.w.e.e.I.H.P.O.........M.L.............e.f.S.S.=.<.....w.v.................^.`.C.B.@.?.....x.x.........-.-.........w.w.G.G.............8.8.....

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\save.dat

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):156
                                                                          Entropy (8bit):5.382465024486233
                                                                          Encrypted:false
                                                                          SSDEEP:3:VlslJLEHF6/06kjv5Yx7Ter+WXvjMX7bTHKMZKkHZSbiaxNNN4+8un:VlslJLElz6kjRYJer7E7bGKaNttn
                                                                          MD5:721909B7452B1D86F00CC6032BFF20F8
                                                                          SHA1:4A5352A33EB467EE81AD3DB8B5710BC93E17CDE5
                                                                          SHA-256:54C4D461873BFD5BCEC97E7657C4ECEABB5AAEDE3DC8AA3039EF25C710D12CCA
                                                                          SHA-512:0CA90E04882F966F93919FFAF13C4BEEA48093E8AB5C9351C0CA94C519B220E8B9566A46CD216C926CF6F9250295C0A873B1041A9435BC61A596A9B23A095D79
                                                                          Malicious:false
                                                                          Preview:...........].(..pynput.keyboard._win32...KeyCode...)..}.(..vk.KA..char...a...is_dead....combining.N.._flags.N.._scan.K.ubh.)..}.(h.KDh...d.h..h.Nh.Nh.K ube.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\select.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):30488
                                                                          Entropy (8bit):6.584716253229207
                                                                          Encrypted:false
                                                                          SSDEEP:384:aEeecReGLnUC0HqGn57AvB0NJIyQGdHQIYiSy1pCQUNIeAM+o/8E9VF0NylE3X:SeUeW4HqIG+JIyQGB5YiSyv2AMxkEg3X
                                                                          MD5:0B55F18218F4C8F30105DB9F179AFB2C
                                                                          SHA1:F1914831CF0A1AF678970824F1C4438CC05F5587
                                                                          SHA-256:E7FE45BAEF9CEE192C65FCFCE1790CCB6F3F9B81E86DF82C08F838E86275AF02
                                                                          SHA-512:428EE25E99F882AF5AD0DEDF1CCDBEB1B4022AC286AF23B209947A910BF02AE18A761F3152990C84397649702D8208FED269AA3E3A3C65770E21EE1EEC064CC1
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d....'ne.........." ...%.....2.......................................................-....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl86t.dll

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1867160
                                                                          Entropy (8bit):6.513719329831835
                                                                          Encrypted:false
                                                                          SSDEEP:24576:6NJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBHU:6Ngjid2LD5W4ac6xdLvIkhHP4ATdeDZ
                                                                          MD5:AC6CD2FB2CD91780DB186B8D6E447B7C
                                                                          SHA1:B387B9B6CA5F0A2B70028AB2147789C4FE24EF7A
                                                                          SHA-256:A91781FE13548B89817462B00058A75FB0B607EC8CE99D265719CED573ADE7B6
                                                                          SHA-512:45B24CA07A44D8D90E5EFEDED2697A37F000B39D305FE63A67292FDD237DE3F8EFD5E85B139B5702FAA695F9F27F12F24AC497E005E2F3C24C141D7CD85305B6
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..v`..%`..%`..%2.$b..%..x%c..%2.$l..%2.$h..%2.$d..%i..%r..%..$a..%..$m..%`..%y..%..$..%..$a..%..z%a..%..$a..%Rich`..%........PE..d.....b.........." .....................................................................`.........................................@....`...+..T.......8............^..............P...............................p...8............................................text...H........................... ..`.rdata..............................@..@.data....#...P.......<..............@....pdata...............D..............@..@.rsrc...8............<..............@..@.reloc...............@..............@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8\8.4\platform-1.0.18.tm

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):11423
                                                                          Entropy (8bit):5.034817754935299
                                                                          Encrypted:false
                                                                          SSDEEP:192:rXlm2LnoZ7k2mOEhYoKVtWD2xLsmF+MNlPQ4lJ+B0O0DgryYY/+zf7gZ:rXlm2Lng7kvF2VtWD2xLeMNT+B0O0Uro
                                                                          MD5:628A1F34F7B7149303918E52114D2C3B
                                                                          SHA1:DBE52586BB784940D1EEADC6A2C6985F5A0D4A80
                                                                          SHA-256:C96140D154C3BDC0A13A06C8B8B7628DFCD014DF827704D1DBCB2B3B38349605
                                                                          SHA-512:560F1121F25C8558335DBBBBF38A382A68619F2A28967820B56266F548BF33FC23F3D13B77B4EF2D23B8330F6B6EC0E089EB1FF3864FED3F71CA28CE0A79EFB7
                                                                          Malicious:false
                                                                          Preview:# -*- tcl -*-..# ### ### ### ######### ######### #########..## Overview....# Heuristics to assemble a platform identifier from publicly available..# information. The identifier describes the platform of the currently..# running tcl shell. This is a mixture of the runtime environment and..# of build-time properties of the executable itself...#..# Examples:..# <1> A tcl shell executing on a x86_64 processor, but having a..# wordsize of 4 was compiled for the x86 environment, i.e. 32..# bit, and loaded packages have to match that, and not the..# actual cpu...#..# <2> The hp/solaris 32/64 bit builds of the core cannot be..# distinguished by looking at tcl_platform. As packages have to..# match the 32/64 information we have to look in more places. In..# this case we inspect the executable itself (magic numbers,..# i.e. fileutil::magic::filetype)...#..# The basic information used comes out of the 'os' and 'machine'..# entries of the 'tcl_platform' array. A number of general and

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8\8.4\platform\shell-1.1.4.tm

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6218
                                                                          Entropy (8bit):4.843141834641668
                                                                          Encrypted:false
                                                                          SSDEEP:192:PV5U+VLnNUPVvH+knNUPVUHD5ngWftN+IgMufIdqi+g0SYiCXVDjqL:Nm6MFXN5uwq51iCFD2
                                                                          MD5:8ABC3029963E433D1D9865AAA7E1057B
                                                                          SHA1:A88091DC98B2FD0AE3A258B59F8BE43F41F04323
                                                                          SHA-256:0A6B4B109CFDFC4B40FBDEFDB2282F9B1AF3CC2F9624DD39958EEBD78781AFB2
                                                                          SHA-512:D5068375615A2200DDC13EEB852B2E21B7E4AA416FB7A0E97C98B8B106D7701792C523739E8BF266D2ABE411D4298A0B5B3884CFB9DF820FD4A2B61B22F9DECF
                                                                          Malicious:false
                                                                          Preview:..# -*- tcl -*-..# ### ### ### ######### ######### #########..## Overview....# Higher-level commands which invoke the functionality of this package..# for an arbitrary tcl shell (tclsh, wish, ...). This is required by a..# repository as while the tcl shell executing packages uses the same..# platform in general as a repository application there can be..# differences in detail (i.e. 32/64 bit builds).....# ### ### ### ######### ######### #########..## Requirements....package require platform..namespace eval ::platform::shell {}....# ### ### ### ######### ######### #########..## Implementation....# -- platform::shell::generic....proc ::platform::shell::generic {shell} {.. # Argument is the path to a tcl shell..... CHECK $shell.. LOCATE base out.... set code {}.. # Forget any pre-existing platform package, it might be in.. # conflict with this one... lappend code {package forget platform}.. # Inject our platform package.. lappend code [list source $base]..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8\8.5\msgcat-1.6.1.tm

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):35136
                                                                          Entropy (8bit):4.945501767273492
                                                                          Encrypted:false
                                                                          SSDEEP:768:m3xQvCzasI/rHPG2yfkZ0Kbh91iQ3Lnq5MIVYB8mbgijsPIWtw4qvUm:4xQvCzasIDHPG2yW0kJ32imXmUij6JjG
                                                                          MD5:BD4FF2A1F742D9E6E699EEEE5E678AD1
                                                                          SHA1:811AD83AFF80131BA73ABC546C6BD78453BF3EB9
                                                                          SHA-256:6774519F179872EC5292523F2788B77B2B839E15665037E097A0D4EDDDD1C6FB
                                                                          SHA-512:B77E4A68017BA57C06876B21B8110C636F9BA1DD0BA9D7A0C50096F3F6391508CF3562DD94ACEAF673113DBD336109DA958044AEFAC0AFB0F833A652E4438F43
                                                                          Malicious:false
                                                                          Preview:# msgcat.tcl --..#..#.This file defines various procedures which implement a..#.message catalog facility for Tcl programs. It should be..#.loaded with the command "package require msgcat"...#..# Copyright (c) 2010-2015 Harald Oehlmann...# Copyright (c) 1998-2000 Ajuba Solutions...# Copyright (c) 1998 Mark Harrison...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....package require Tcl 8.5-..# When the version number changes, be sure to update the pkgIndex.tcl file,..# and the installation directory in the Makefiles...package provide msgcat 1.6.1....namespace eval msgcat {.. namespace export mc mcexists mcload mclocale mcmax mcmset mcpreferences mcset\.. mcunknown mcflset mcflmset mcloadedlocales mcforgetpackage\... mcpackageconfig mcpackagelocale.... # Records the list of locales to search.. variable Loclist {}.... # List of currently loaded locales.. variable LoadedLoc

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8\8.5\tcltest-2.5.3.tm

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):107041
                                                                          Entropy (8bit):4.838727837954522
                                                                          Encrypted:false
                                                                          SSDEEP:3072:7zsUYg6sali4N8uBPS5PP9AlGXJL/RiBh:74UDqli4N8uBPS5PP9AYXJL/RiBh
                                                                          MD5:B65B89714DE27DC64557882FD4A9F28A
                                                                          SHA1:8FD99F1AB678A9BBAE0B7BD492C6EAE6801FC4AB
                                                                          SHA-256:F6931F88AE2A4E63D77EEC83E58F5944D66C7EF5F335A51064E8023E0C842971
                                                                          SHA-512:BC39C99C94D870D4AFAAC1E641806E110E3CAE6A459F7B6FDB543E4D4E14FE4462B60BC77F192EEE352D48C71E6F15F3C0989D3860F8272A32186F45E86DC963
                                                                          Malicious:false
                                                                          Preview:# tcltest.tcl --..#..#.This file contains support code for the Tcl test suite. It..# defines the tcltest namespace and finds and defines the output..# directory, constraints available, output and error channels,..#.etc. used by Tcl tests. See the tcltest man page for more..#.details...#..# This design was based on the Tcl testing approach designed and..# initially implemented by Mary Ann May-Pumphrey of Sun..#.Microsystems...#..# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2000 Ajuba Solutions..# Contributions from Don Porter, NIST, 2002. (not subject to US copyright)..# All rights reserved.....package require Tcl 8.5-..;# -verbose line uses [info frame]..namespace eval tcltest {.... # When the version number changes, be sure to update the pkgIndex.tcl file,.. # and the install directory in the Makefiles. When the minor version.. # changes (new feature) be sure to update the man p

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl8\8.6\http-2.9.5.tm

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):115215
                                                                          Entropy (8bit):4.8838770373771405
                                                                          Encrypted:false
                                                                          SSDEEP:1536:SYY1IO/Kufhf17a6DLJuuBuzEj6aIsGc3e6YhTjn82872y4e2BxIQAIk:SbyOCufBQaLJOEjlxTYhTjn828CBevQM
                                                                          MD5:02B5B1026BD2CB9C7CEFFEB7E098AD18
                                                                          SHA1:729CDB4F852531A0A4BFBBBC64F11EA4E6B90A66
                                                                          SHA-256:226347B0FAE4A3ED9237CE64C998C2A88B4FDD3D7F85A081B7CAB3E863FEB13D
                                                                          SHA-512:805EBBF7660357AC7234CC9EAC0566BE506B7A20E59A2EE13869EF4FC2D407C6F12B705EDE5033A24D37860887C4337B660D8CEF89030AAD4AF659DA9664EB10
                                                                          Malicious:false
                                                                          Preview:# http.tcl --..#..#.Client-side HTTP for GET, POST, and HEAD commands. These routines can..#.be used in untrusted code that uses the Safesock security policy...#.These procedures use a callback interface to avoid using vwait, which..#.is not defined in the safe base...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....package require Tcl 8.6-..# Keep this in sync with pkgIndex.tcl and with the install directories in..# Makefiles..package provide http 2.9.5....namespace eval http {.. # Allow resourcing to not clobber existing data.... variable http.. if {![info exists http]} {...array set http {... -accept */*... -pipeline 1... -postfresh 0... -proxyhost {}... -proxyport {}... -proxyfilter http::ProxyRequired... -repost 0... -urlencoding utf-8... -zip 1...}...# We need a useragent string of this style or various servers will...# refuse to send us compressed content

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\auto.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):21523
                                                                          Entropy (8bit):4.827830596623684
                                                                          Encrypted:false
                                                                          SSDEEP:384:UqT9XC9VZv9QXCTxsCTHI7672ORgS0mzBvxFRTX7Xvt3wBTnFXhCUvuyqz:LT9XC9VZviXCVsCLI7JlmzBvTxvt3gTW
                                                                          MD5:08EDF746B4A088CB4185C165177BD604
                                                                          SHA1:395CDA114F23E513EEF4618DA39BB86D034124BF
                                                                          SHA-256:517204EE436D08EFC287ABC97433C3BFFCAF42EC6592A3009B9FD3B985AD772C
                                                                          SHA-512:C1727E265A6B0B54773C886A1BCE73512E799BA81A4FCEEEB84CDC33F5505A5E0984E96326A78C46BF142BC4652A80E213886F60EB54ADF92E4DFFE953C87F6B
                                                                          Malicious:false
                                                                          Preview:# auto.tcl --..#..# utility procs formerly in init.tcl dealing with auto execution of commands..# and can be auto loaded themselves...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# auto_reset --..#..# Destroy all cached information for auto-loading and auto-execution, so that..# the information gets recomputed the next time it's needed. Also delete any..# commands that are listed in the auto-load index...#..# Arguments:..# None.....proc auto_reset {} {.. global auto_execs auto_index auto_path.. if {[array exists auto_index]} {...foreach cmdName [array names auto_index] {... set fqcn [namespace which $cmdName]... if {$fqcn eq ""} {....continue... }... rename $fqcn {}...}.. }.. unset -nocomplain auto_execs auto_index ::tcl::auto_oldpath.. if {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\clock.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):133439
                                                                          Entropy (8bit):5.044814789288095
                                                                          Encrypted:false
                                                                          SSDEEP:3072:Cbn4IAhYvuCg9epsArAzqpSMpWzP7ejMiIAxBPqGYkPAPaZpHYM8EN4LhVLlarXL:Cbn4IM9epsArSqpSMpWzP7ejM/eBPqG3
                                                                          MD5:88BB44A1364147FDD80F9FD78FBCEF61
                                                                          SHA1:2C3454D2669F0CA83FECF17976D599C85B86E615
                                                                          SHA-256:1947F8B188AB4AB6AA72EA68A58D2D9ADD0894FDF320F6B074EAE0F198368FB7
                                                                          SHA-512:010B13E8A2D50521B5D7ADCC5F32F7CDE3F12E1053961C575D967DC6CFD368640BF45D23832E5E9C3868CDCA9FE0505698F949C5557D4169353634C94AA196B5
                                                                          Malicious:false
                                                                          Preview:#----------------------------------------------------------------------..#..# clock.tcl --..#..#.This file implements the portions of the [clock] ensemble that are..#.coded in Tcl. Refer to the users' manual to see the description of..#.the [clock] command and its subcommands...#..#..#----------------------------------------------------------------------..#..# Copyright (c) 2004-2007 Kevin B. Kenny..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#..#----------------------------------------------------------------------....# We must have message catalogs that support the root locale, and we need..# access to the Registry on Windows systems.....uplevel \#0 {.. package require msgcat 1.6.. if { $::tcl_platform(platform) eq {windows} } {...if { [catch { package require registry 1.1 }] } {... namespace eval ::tcl::clock [list variable NoRegistry {}]...}.. }..}....# Put the library directory in

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\ascii.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):2.1033474959326957
                                                                          Encrypted:false
                                                                          SSDEEP:12:5c2VBUvEWVrVJ/eyN9j2iV2NdWWT0VbusV7EV7KVAMmVZyd851VFpsGkliX:5HVBUlJvRj7SOVbusZhAMiZyi77qsX
                                                                          MD5:9E3A454FA480E9A99D2D5ACDAA775233
                                                                          SHA1:493637BB570A5C96BB62F998BD0391FB59AFC5F0
                                                                          SHA-256:FB87BF197F4F485B08EA81F7534BC07D9C3A538D022424BE11011A1FE3C413FD
                                                                          SHA-512:EDFCB2BB6AB052D28D5CEBD08AD57F36D3A4CB83D557B1359B0ADE1266E24D8F3CE87B8240881396A5BA4FB45F8B74014784E8885CDB86680D98977CC0D130F0
                                                                          Malicious:false
                                                                          Preview:# Encoding file: ascii, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\big5.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):94389
                                                                          Entropy (8bit):3.3217406555698195
                                                                          Encrypted:false
                                                                          SSDEEP:768:UAHU3LIkZlmXrd/uQ0ao98zgKSTEvZPHb6qRL5NpiadDp0ZBFR6YR/fd:UVduBGf94gFMT6q95GDRBfd
                                                                          MD5:41A874778111CC218BD421CF9C795EC2
                                                                          SHA1:80857D106F71199CE187833D38DB091A819A520C
                                                                          SHA-256:AD1ED201B69855BFD353BF969DFC55576DA35A963ABF1BF7FC6D8B5142A61A61
                                                                          SHA-512:4244624124F86A3EFAB4C70B115A46C8ADF02D708860FA5F327CDBFA24BC3F9EFAD0C6EE58DE96B0B6BBC4CF6D99B322BB8657129007C86D6482F41C1503AAD4
                                                                          Malicious:false
                                                                          Preview:# Encoding file: big5, multi-byte..M..003F 0 89..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cns11643.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):98634
                                                                          Entropy (8bit):2.438904802083714
                                                                          Encrypted:false
                                                                          SSDEEP:768:MPFOsOKqBLPf62X4lgQeLHj6RHUn0TQb8G47Ianrd28gr:MPAsknjX4OQe7aoMMarAFr
                                                                          MD5:B6A7C59E6A48D91CC2DBCB2BBA7E4510
                                                                          SHA1:16A9338F18202B26981F2028BEA412DD03BB0FF2
                                                                          SHA-256:8924545CC92584169138AADB64683C07BBF846A57014C2E668D23B63F43F3610
                                                                          SHA-512:3D644CF394A528A8699BE3679F787A4E1DAD657C04B810580A4C520F2C043471640FBE080AC46DFD3924C47A73BEE12A6AC69D291D09EB791AD0D64A73750B43
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cns11643, double-byte..D..2134 0 93..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00004E284E364E3F4E854E054E04518251965338536953B64E2A4E874E4951E2..4E464E8F4EBC4EBE516651E35204529C53B95902590A5B805DDB5E7A5E7F5EF4..5F505F515F61961D4E3C4E634E624EA351854EC54ECF4ECE4ECC518451865722..572351E45205529E529D52FD5300533A5C735346535D538653B7620953CC6C15..53CE57216C3F5E005F0C623762386534653565E04F0E738D4E974EE04F144EF1..4EE74EF74EE64F1D4F024F054F2256D8518B518C519951E55213520B52A60000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1250.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.3578844928761034
                                                                          Encrypted:false
                                                                          SSDEEP:24:CqHVBUlJvRj7SOVbusZhAMiZyi77q8ujr4z8tjsuVO6ys2K:JMlBVnrAMiwMm8ujr4z8emTys2K
                                                                          MD5:9568EDE60D3F917F1671F5A625A801C4
                                                                          SHA1:4F5B3308FE7F6845B46779DECF9B395E47AC7396
                                                                          SHA-256:E2991A6F7A7A4D8D3C4C97947298FD5BACB3EAA2F898CEE17F5E21A9861B9626
                                                                          SHA-512:9C32BE3E25FC2211CE91F7B9AE1F9EBA20071272BE2BBBA63A8B6E3CD6543C4C32CD62C4C4D153C94F5BE212E974A61EEFD70DDC005F1688D09D9D56E8E298A8
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1250, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0083201E2026202020210088203001602039015A0164017D0179..009020182019201C201D202220132014009821220161203A015B0165017E017A..00A002C702D8014100A4010400A600A700A800A9015E00AB00AC00AD00AE017B..00B000B102DB014200B400B500B600B700B80105015F00BB013D02DD013E017C..015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E..01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF..015500E100E2010300E40

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1251.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.358948900439905
                                                                          Encrypted:false
                                                                          SSDEEP:24:CTHVBUlJvRj7SOVbusZhAMiZyi77qpREwKsF/+++SAJlz9aRme3cJI:wMlBVnrAMiwMmpKwKm/EYnsJI
                                                                          MD5:83DAF47FD1F87B7B1E9E086F14C39E5B
                                                                          SHA1:77AE330512EBFEF430A02213644BD1CFCE174298
                                                                          SHA-256:0AA66DFF8A7AE570FEE83A803F8F5391D9F0C9BD6311796592D9B6E8E36BE6FC
                                                                          SHA-512:D7CE2F44EDFE1DA6D3E07E9A41BB08AD42430BAAFADD09FD217F4B524323A01A1F4913B640C552D38AAEBFF75B0D50ED7A813A2A57C4019311158890C0162DF9
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1251, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..04020403201A0453201E20262020202120AC203004092039040A040C040B040F..045220182019201C201D202220132014009821220459203A045A045C045B045F..00A0040E045E040800A4049000A600A7040100A9040400AB00AC00AD00AE0407..00B000B104060456049100B500B600B704512116045400BB0458040504550457..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..043004310432043304340

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1252.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.292994562910468
                                                                          Encrypted:false
                                                                          SSDEEP:24:C4HVBUlJvRj7SOVbusZhAMiZyi77qdmV/rcwvGNNlkL+rSMH+tKv:rMlBVnrAMiwMmd2r/okLz0
                                                                          MD5:E9117326C06FEE02C478027CB625C7D8
                                                                          SHA1:2ED4092D573289925A5B71625CF43CC82B901DAF
                                                                          SHA-256:741859CF238C3A63BBB20EC6ED51E46451372BB221CFFF438297D261D0561C2E
                                                                          SHA-512:D0A39BC41ADC32F2F20B1A0EBAD33BF48DFA6ED5CC1D8F92700CDD431DB6C794C09D9F08BB5709B394ACF54116C3A1E060E2ABCC6B503E1501F8364D3EEBCD52
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1252, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030016020390152008D017D008F..009020182019201C201D20222013201402DC21220161203A0153009D017E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300E40

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1253.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.422723556981327
                                                                          Encrypted:false
                                                                          SSDEEP:24:CRHVBUlJvRj7SOVbusZhAMiZyi77qduWn4T5K9QQSqiWeIDDdn:CMlBVnrAMiwMmduWnSKyQSqiWeIVn
                                                                          MD5:441B86A0DE77F25C91DF1CD4685F651D
                                                                          SHA1:D1E429916BC9423F55EEC8F17941521E9FE9D32B
                                                                          SHA-256:5B8D47451F847C1BDE12CACA3739CA29860553C0B6399EE990D51B26F9A69722
                                                                          SHA-512:35DF342DDA4E8790C6D53762465DF8B93B49B7B7E211D7A5753078EF559C9C9383EFF7285A90FF5C0020FBB16AF380EE3C8643F4CEB1E41917E72021079D722F
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1253, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202100882030008A2039008C008D008E008F..009020182019201C201D20222013201400982122009A203A009C009D009E009F..00A00385038600A300A400A500A600A700A800A9000000AB00AC00AD00AE2015..00B000B100B200B3038400B500B600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303B40

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1254.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.307590929679485
                                                                          Encrypted:false
                                                                          SSDEEP:24:CWHVBUlJvRj7SOVbusZhAMiZyi77qdjrcFvGNNlkBSMH+tA/b:lMlBVnrAMiwMmdjriokgzAD
                                                                          MD5:5FA9162BEC5A4DEA97B5EA2840CFB065
                                                                          SHA1:F26858E3D2FB928F39CA87CBB8446AF099570CAD
                                                                          SHA-256:31639CA96A4D3602D59BD012540FE179917E0561CB11A0D0B61F1B950EB76911
                                                                          SHA-512:3CE7BEABBE1A0CB946149D263D3317A8B791F6D72C49DEC4621E27F50CC359D8FA3EE97C03FF05D44E47DAA59DB87F219386467614B8B3FF8CC21AB3E3BED5E6
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1254, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030016020390152008D008E008F..009020182019201C201D20222013201402DC21220161203A0153009D009E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300E40

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1255.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.3385880810272774
                                                                          Encrypted:false
                                                                          SSDEEP:24:CfHVBUlJvRj7SOVbusZhAMiZyi77qdIn2hEeGlRhv6Mw6Kcv:MMlBVnrAMiwMmdInSEdhvrj7
                                                                          MD5:6DEA4179969D6C81C66C3B0F91B39769
                                                                          SHA1:7E2722576BFFABC3258C5EDB2D99FA2468D6A4B0
                                                                          SHA-256:47576CAE321C80E69C7F35205639680BF28010111E86E228ED191B084FAC6B91
                                                                          SHA-512:91CC626B6454517F06FB3616E9ED623D1A2A4BFE74AFA9885F00F6AEC835D8825A5587091B9D9AB0E5ABDA291FA3FE7CE87E2618E21EB2974D9118AE27B8A2FF
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1255, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030008A2039008C008D008E008F..009020182019201C201D20222013201402DC2122009A203A009C009D009E009F..00A000A100A200A320AA00A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE00BF..05B005B105B205B305B405B505B605B705B805B9000005BB05BC05BD05BE05BF..05C005C105C205C305F005F105F205F305F40000000000000000000000000000..05D005D105D205D305D40

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1256.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.4033510023542655
                                                                          Encrypted:false
                                                                          SSDEEP:24:C0HVBUlJvRj7SOVbusZhAMiZyi77q30pPE7Lym4cwGm+AMZjyG/JQIG/Y:XMlBVnrAMiwMm30FQLym4ys6Jg/Y
                                                                          MD5:D50DFAFEE5C605C5C00A25A9EEE4D4CF
                                                                          SHA1:7D51BC17931D3D809716C06E7F07C6011286A144
                                                                          SHA-256:29340EA8E5AD3532BF67FA77CC852F055081B1238925CB109908AA72804CCC04
                                                                          SHA-512:D0A9B422A1061D6239E442767069B987E33239FCBA9BACE677923888F5F8BD1DCAABC71B83A985A0A86A15DCC44316781665BBFBF24558FCB94FDA6783285BCB
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1256, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC067E201A0192201E20262020202102C62030067920390152068606980688..06AF20182019201C201D20222013201406A921220691203A0153200C200D06BA..00A0060C00A200A300A400A500A600A700A800A906BE00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B9061B00BB00BC00BD00BE061F..06C1062106220623062406250626062706280629062A062B062C062D062E062F..063006310632063306340635063600D7063706380639063A0640064106420643..00E0064400E2064506460

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1257.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.344584404753015
                                                                          Encrypted:false
                                                                          SSDEEP:24:CNHVBUlJvRj7SOVbusZhAMiZyi77q8uWTfNL4wIBUioGndt:uMlBVnrAMiwMm8uWJDNIt
                                                                          MD5:CC3D24543FDD4644BBBD4AAB30CA71BC
                                                                          SHA1:8E2658E7F782F005411BCB8423BDFC3C68BDED14
                                                                          SHA-256:C15AB85438728BF2C60D72B1A66AF80E8B1CE3CF5EB08BA6421FF1B2F73ACDF4
                                                                          SHA-512:5ECABF820098F7D24AB806ADD9CA3E1087C29914FB2DE6BA3DC656234202DE3FDF80A7E9ED433CCB2149FF07184F74884CEB37A1B689E9E0C1402916F3E13AFE
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1257, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0083201E20262020202100882030008A2039008C00A802C700B8..009020182019201C201D20222013201400982122009A203A009C00AF02DB009F..00A0000000A200A300A4000000A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B300B400B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F0101010700E40

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp1258.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.2984943182702593
                                                                          Encrypted:false
                                                                          SSDEEP:24:CKlHVBUlJvRj7SOVbusZhAMiZyi77qdIQ2jFvGNNykoxWi3/i:xMlBVnrAMiwMmdIQufkoxn3q
                                                                          MD5:12BCEAE6B6A5FAE5AE9C42F5998BA485
                                                                          SHA1:C9620DA0C763D2C3770386E69EE7E421BD1BA965
                                                                          SHA-256:29D93DEE7C01B2264778BC6B75F6EF76EA6AC53E9F4A334D83707229E7F482D2
                                                                          SHA-512:714BAF58462FB0E84A32D82C8FC2D63EDF78DF8CCE578391E2521737F94F860B5CCFE41B481E1D09879A6811FCFD8B98A2724DB1D15749BD5293A9B33BCAD071
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp1258, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030008A20390152008D008E008F..009020182019201C201D20222013201402DC2122009A203A0153009D009E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C2010200C400C500C600C700C800C900CA00CB030000CD00CE00CF..011000D1030900D300D401A000D600D700D800D900DA00DB00DC01AF030300DF..00E000E100E2010300E40

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp437.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.515546664597914
                                                                          Encrypted:false
                                                                          SSDEEP:24:CFyHVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBIqE18wDyV8mK:wyMlBVnrAMiwMm+VhE1LmK
                                                                          MD5:CE6D8A6542DC12D1783084FA4B2B63EA
                                                                          SHA1:5039A350C8E3E2C6F353B438B41BD0B6A7AB8069
                                                                          SHA-256:E5613C04D3D2EE44CCAD85AE53A37C257674491C540836E5D942BBCC4E4A8DB4
                                                                          SHA-512:E8C5CFB747486BBE0E567B6E87B59D5246D749A80C8F64F6669227C7FD849886F98A1F94451922AC099409AC14890F1A8B1E5F25EA584FDB1522ACE3AD0BE6A6
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp437, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00A200A300A520A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp737.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.6177058818384693
                                                                          Encrypted:false
                                                                          SSDEEP:24:CjHVBUlJvRj7SOVbusZhAMiZyi77qSKOQFhWehDrq18wDyVKockoiH:WMlBVnrAMiwMmSKOQFhWeh3q1odH
                                                                          MD5:8EF3CBCA101F5777846D12D3C96A0A7D
                                                                          SHA1:5EC5418B861894E0F18EA15AA4414019815E2EA2
                                                                          SHA-256:A0415F14F5D72AD24E9C3A5C91517A0E3D22E1ADBC3505C0C6E918B961F7A07D
                                                                          SHA-512:FB14C88E61E5459B4A8706751D88D0A261AC6B4171F72912D87CE78A2BC97A821CCF5B53676FB229C08F9E557BE624F4DC649B722A906B9B7944ED2D5E7F9065
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp737, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..039103920393039403950396039703980399039A039B039C039D039E039F03A0..03A103A303A403A503A603A703A803A903B103B203B303B403B503B603B703B8..03B903BA03BB03BC03BD03BE03BF03C003C103C303C203C403C503C603C703C8..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03C903AC03AD03AE03CA03

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp775.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.451057608106102
                                                                          Encrypted:false
                                                                          SSDEEP:24:CsOHVBUlJvRj7SOVbusZhAMiZyi77qoo9ecL067J4ZNUPVw3PfA:AMlBVnrAMiwMm59T067KDLPo
                                                                          MD5:9656761FA02EA24773EAD3E5C4BDB975
                                                                          SHA1:366228F25392708FA799E9CC0830CE9917EF6CA7
                                                                          SHA-256:C3C6542E902DEC2C44DDCFD8B5CB7ABF309B0413A7CED1614DC0B20CF7C5E35F
                                                                          SHA-512:A6A44B9A2193D75764DC284BE53264E57BFEB2A221FD54B4577DD90752F69A45E6B9D293108A7AB895F347A24FD10AAE84954A043AB1F466F485D707D7412380
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp775, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..010600FC00E9010100E4012300E501070142011301560157012B017900C400C5..00C900E600C6014D00F6012200A2015A015B00D600DC00F800A300D800D700A4..0100012A00F3017B017C017A201D00A600A900AE00AC00BD00BC014100AB00BB..259125922593250225240104010C01180116256325512557255D012E01602510..25142534252C251C2500253C0172016A255A25542569256625602550256C017D..0105010D01190117012F01610173016B017E2518250C25882584258C25902580..00D300DF014C014300F500

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp850.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.3718781469586827
                                                                          Encrypted:false
                                                                          SSDEEP:24:C9HVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBc+myS5LeQDTVwA:EMlBVnrAMiwMm+VeyS5SQn/
                                                                          MD5:2169EE726DCC011E6C3505D586C88FC3
                                                                          SHA1:094252AD0634787E2D7F0D28A448437054D359C7
                                                                          SHA-256:13DF611F429A9B331DA1B34F3C718CCCAF0BD4AB44F71A9C632197987B4D643B
                                                                          SHA-512:BC5831EF1C131095A22C76FFCB5C4217081AF796B60455BE2DE2E2689CFE1033F07E8B45449F77E7804A7D52CBCFB916B0B4639828E65B14475BB3367F47C8EE
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp850, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D800D70192..00E100ED00F300FA00F100D100AA00BA00BF00AE00AC00BD00BC00A100AB00BB..2591259225932502252400C100C200C000A9256325512557255D00A200A52510..25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4..00F000D000CA00CB00C8013100CD00CE00CF2518250C2588258400A600CC2580..00D300DF00D400D200F500

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp852.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.4509005787389877
                                                                          Encrypted:false
                                                                          SSDEEP:24:CPHVBUlJvRj7SOVbusZhAMiZyi77q7EUsOtycwQIc+922V:mMlBVnrAMiwMmwvOtycwQIc+9R
                                                                          MD5:48402B424B5101BDEEB0192BBA96DB7D
                                                                          SHA1:C9EB93A37AF70F4134AA9CF05D914A30FB3201DD
                                                                          SHA-256:F3A18A8C7934F6586F023477E08D3F9D5EAD9A45E9E58A3F8D018AF9BB13F868
                                                                          SHA-512:4EE615605BFF3D94A7FC4FE23D8288F0F20F6792C8C69ECACABAE82F1A334D8417C5DFFC0DA3702E2DB09B7BE1E5FF19C6A0F460C9A5EC84D1856BB9C8061CA5
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp852, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E4016F010700E7014200EB0150015100EE017900C40106..00C90139013A00F400F6013D013E015A015B00D600DC01640165014100D7010D..00E100ED00F300FA01040105017D017E0118011900AC017A010C015F00AB00BB..2591259225932502252400C100C2011A015E256325512557255D017B017C2510..25142534252C251C2500253C01020103255A25542569256625602550256C00A4..01110110010E00CB010F014700CD00CE011B2518250C258825840162016E2580..00D300DF00D40143014401

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp855.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.4277025591531864
                                                                          Encrypted:false
                                                                          SSDEEP:24:CoHVBUlJvRj7SOVbusZhAMiZyi77qLHVWjwk/rMZC032SLnD2JbD:hMlBVnrAMiwMmx8whM03VLDy
                                                                          MD5:8B8AA56F83BA750EB73FAE542E76FF1A
                                                                          SHA1:2F3C3BA4B854A7D6B0A3D27BC519EE66A042E05A
                                                                          SHA-256:E64FD2E639DA6F654D9BFBB2266F9432259A6A55941622F5CDDC3797E382EB0A
                                                                          SHA-512:8B4061176663F7AC01B3969D25F680B5870A8EAD864CFAD897F18E75409CE721E6CC367A88EBABAF72E77D4542EE1894F2A6EE47A43FB3D4C650CFA18DFD3D71
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp855, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0452040204530403045104010454040404550405045604060457040704580408..04590409045A040A045B040B045C040C045E040E045F040F044E042E044A042A..0430041004310411044604260434041404350415044404240433041300AB00BB..259125922593250225240445042504380418256325512557255D043904192510..25142534252C251C2500253C043A041A255A25542569256625602550256C00A4..043B041B043C041C043D041D043E041E043F2518250C25882584041F044F2580..042F044004200441042104

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp857.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.364496856690505
                                                                          Encrypted:false
                                                                          SSDEEP:24:CaHVBUlJvRj7SOVbusZhAMiZyi77qZpu6uUV5Dw5LeBCVHjzA:jMlBVnrAMiwMmyUVFw5SYdI
                                                                          MD5:BA52A031DE1B1A6ED1C41BED8946750C
                                                                          SHA1:BD54C0E2F62FD36675892A61FD8B340A56845D20
                                                                          SHA-256:B6CD5C6F2B54D89142679D599ED0A5DEE6955A3B3F6B6673E46AFE7A5A303CDC
                                                                          SHA-512:5F915AABE39F31CE9337B4B9B0239DF8ADA898D2D9F111DD09D97689DB89CF45B093AC187FC28484CFB213D14B0D8F58C5668D0A59726282D6F52D5D24697816
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp857, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE013100C400C5..00C900E600C600F400F600F200FB00F9013000D600DC00F800A300D8015E015F..00E100ED00F300FA00F100D1011E011F00BF00AE00AC00BD00BC00A100AB00BB..2591259225932502252400C100C200C000A9256325512557255D00A200A52510..25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4..00BA00AA00CA00CB00C8000000CD00CE00CF2518250C2588258400A600CC2580..00D300DF00D400D200F500

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp860.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.506813480871637
                                                                          Encrypted:false
                                                                          SSDEEP:24:CMHVBUlJvRj7SOVbusZhAMiZyi77qij4Axlt49Y18wDyV8mK:VMlBVnrAMiwMm/g+9Y1LmK
                                                                          MD5:C416471B57FB894DC45D30C31B4BD2E2
                                                                          SHA1:BA378F8122280992AE51245A06814D8155564220
                                                                          SHA-256:804EFA345C5BBBAD2449C318A7A3F5B31F4234712AAD23DC49B3FB5AA33B7A57
                                                                          SHA-512:E7CDE706CFE573525C2DE319AD5783AE9D97C4F6D28B14A77A729F281540B0DAFAD4C14879EF76473BFDEBC38499C65CA228470983F2D1BC31938A91A2486522
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp860, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E300E000C100E700EA00CA00E800CD00D400EC00C300C2..00C900C000C800F400F500F200DA00F900CC00D500DC00A200A300D920A700D3..00E100ED00F300FA00F100D100AA00BA00BF00D200AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp861.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.5174672833207183
                                                                          Encrypted:false
                                                                          SSDEEP:24:ClHVBUlJvRj7SOVbusZhAMiZyi77qZpORVPnA2Gm18wDyV8mK:8MlBVnrAMiwMmiVPAA1LmK
                                                                          MD5:4997979FD1692063E2B9AA9870E0BE4C
                                                                          SHA1:919012354B99BBEF4C85517E89A2C9CD340FCE49
                                                                          SHA-256:4B7E76AEB75289FACA76434EA6E9874E9504AD2BC3D8D47550EADBCC8294857E
                                                                          SHA-512:C122A1AE2DE79CB97E5989535B7478A76D905CDE60B01F80F5B84EDB9DF08BE6829E1811AF19608971DA048B8DA24F40DE0217A8054AC612EC2D8B3560500FBE
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp861, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800D000F000DE00C400C5..00C900E600C600F400F600FE00FB00DD00FD00D600DC00F800A300D820A70192..00E100ED00F300FA00C100CD00D300DA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp862.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.5573268031592717
                                                                          Encrypted:false
                                                                          SSDEEP:24:CdMHVBUlJvRj7SOVbusZhAMiZyi77q36AqE18wDyV8mK:iMMlBVnrAMiwMmq3E1LmK
                                                                          MD5:9B4D1B95B20BD67555517DCC3007B22A
                                                                          SHA1:2C0D6121DB49CDAB6FBAA81398BE2E44BE4E1110
                                                                          SHA-256:6C15CB256B1C22170292589C6F589E64E164EB36EC7E84F0BD48149BABB7C5FC
                                                                          SHA-512:34C3E401364D579E8AC7A4E1F1F7A29A84C62E1D5146D7664832639EA3997227DC4BAF1B64DC605E6574D680E61B55D0C69C329E35B1BEC41501FC68C5B634B7
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp862, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..05D005D105D205D305D405D505D605D705D805D905DA05DB05DC05DD05DE05DF..05E005E105E205E305E405E505E605E705E805E905EA00A200A300A520A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp863.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.518080906819747
                                                                          Encrypted:false
                                                                          SSDEEP:24:CXHVBUlJvRj7SOVbusZhAMiZyi77qwGuXVFq5EC18wDyV8mK:eMlBVnrAMiwMmw3VFu1LmK
                                                                          MD5:C93CCDF65F7F349F22855745660F02AE
                                                                          SHA1:604888B1FB3C57DF47277CDD1153597BA89E8C36
                                                                          SHA-256:232D6FE34D7151920232EAAE9C515F36400AB64136DCC5B802D6245AC6F5D56B
                                                                          SHA-512:D5B65AE7353F694A37AF29177BF1A95477918FC5A002C2FE199624BD5B391698807BAECF54225BC40F62B3CA7912C7066A4AAF01B9E3E399133831CAA342BF4F
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp863, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200C200E000B600E700EA00EB00E800EF00EE201700C000A7..00C900C800CA00F400CB00CF00FB00F900A400D400DC00A200A300D900DB0192..00A600B400F300FA00A800B800B300AF00CE231000AC00BD00BC00BE00AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp864.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.72017408907567
                                                                          Encrypted:false
                                                                          SSDEEP:24:CwHVBUlJvRj7YOVbusZhAMiZyi77qcHj92OibcDQAyUjSG:5MlrVnrAMiwMmSsNcDQvcSG
                                                                          MD5:146E0D1779D50E070E0EF875E8374DF8
                                                                          SHA1:B51E5598712598BC387DD79AE80BD879F139140D
                                                                          SHA-256:81BEBFD9A61E9F17495763B68D57742FAB2A1A43871015699A2C8E5FDED4EC19
                                                                          SHA-512:1F0DAD8E77712C5A018894332BE72FF5C546C92F481421CCB8553AD6F1E9A18617765C8CEE4187265CCCB1AB073E221289D34C9AB1F0501231D52C81FC1C932B
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp864, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00200021002200230024066A0026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00B000B72219221A259225002502253C2524252C251C25342510250C25142518..03B2221E03C600B100BD00BC224800AB00BBFEF7FEF8009B009CFEFBFEFC009F..00A000ADFE8200A300A4FE8400000000FE8EFE8FFE95FE99060CFE9DFEA1FEA5..0660066106620663066406650666066706680669FED1061BFEB1FEB5FEB9061F..00A2FE80FE81FE83FE85FECAFE8BFE8DFE91FE93FE97FE9BFE9FFEA3FEA7FEA9..FEABFEADFEAFFEB3FEB7FEBBFEBFFEC1FEC5FECBFECF00A600AC00F700D7FEC9..0640FED3FED7FEDBFEDFFE

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp865.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.5193842128126676
                                                                          Encrypted:false
                                                                          SSDEEP:24:CsKHVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBnAFj18wDyV8mK:gMlBVnrAMiwMm+VRAFj1LmK
                                                                          MD5:150B2E00B3F84F8075F3653ED7A4C8E0
                                                                          SHA1:7131DC656EFE1F2277B19DA72F0EEB46B4EC54A0
                                                                          SHA-256:ADA1A52064EE93EBE6F8A5D101D01F8776038E12F21A5CA1C006EE833577C705
                                                                          SHA-512:AC56EEB0220826BF8FF6CA52768DB63961AAC46095A2F3EEBA11B5973CC92AF52DFBBE9E85A0DD04CAB8998212FA2599EDD83BAAA7FB2D394E330FF2F7C015DB
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp865, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D820A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00A4..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp866.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.5038992968715266
                                                                          Encrypted:false
                                                                          SSDEEP:24:CCHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9aRme3cB18wDyVNZkR:bMlBVnrAMiwMm8YnsB1wZy
                                                                          MD5:FC33B5F773E87696A69E8798446E9772
                                                                          SHA1:4FC5589C1DD88BB8171758BC173A63B3A5687AE5
                                                                          SHA-256:32A45DEBA933C7ED99141535087A4C99BA79802175E3F762ACA6EB941157F85A
                                                                          SHA-512:332D2FEC532192F58F792441E61D675A8692C36BECF768D07F64B8C31561CC1A2DF402625A4719E758A9B59DE4228FFE9F94F067E7DC0D82F9DA2D6500E50304
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp866, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..0440044104420443044404

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp869.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.5261138894265507
                                                                          Encrypted:false
                                                                          SSDEEP:24:CtHVBUlJvRj7SOVbusZhAMiZyi77qii+lh2o5+hdVMQFhWgCDrKE:EMlBVnrAMiwMmXY2o5+hdVMQFhWf3f
                                                                          MD5:4A2C66AA630D4AE2BF1E7546DCE2DAE5
                                                                          SHA1:FABB672957D21CA2B4E0EACA5FCE6093BAACF77A
                                                                          SHA-256:AFE6ED6EB5D07C45B6B928A48BC5EF57EFCF61602D36FF9FBDE4A8EA3FA6DF75
                                                                          SHA-512:A548002EB7AF8735DBBBCC9883B44B326F261C02A3C7CE65C373755DD92212A66740112EAE0FC556CAD5B86911709C6DF12167DC5B6AD1E01C6F1EB5AB16DB37
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp869, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850386008700B700AC00A620182019038820150389..038A03AA038C00930094038E03AB00A9038F00B200B303AC00A303AD03AE03AF..03CA039003CC03CD039103920393039403950396039700BD0398039900AB00BB..25912592259325022524039A039B039C039D256325512557255D039E039F2510..25142534252C251C2500253C03A003A1255A25542569256625602550256C03A3..03A403A503A603A703A803A903B103B203B32518250C2588258403B403B52580..03B603B703B803B903BA03

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp874.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1110
                                                                          Entropy (8bit):3.33737382140564
                                                                          Encrypted:false
                                                                          SSDEEP:24:CSyHVBUlJvRj7SOVbusZhAMiZyi77qVQEHmEU4AyqU+TWwdd:CMlBVnrAMiwMmWr4AyqUSd
                                                                          MD5:FC8C876B4738236FC71A1AF96E4566D0
                                                                          SHA1:DDFDC3F62D99A6BD705CF0719B50F66449C8808A
                                                                          SHA-256:4F05F31CA026BBFEEEE49ED86504CB060784137A9CFAE0E5954D276E837AB5DE
                                                                          SHA-512:5BF58A810E029840825FFF3318E90415E6F2B7E46032FD428B4971923D41A64C127A6F438E4894E80EC9604CD34F1D47B4F9A02ABAB3E7D6351611811DC1F2B9
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp874, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC008100820083008420260086008700880089008A008B008C008D008E008F..009020182019201C201D20222013201400980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E440E

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp932.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):49008
                                                                          Entropy (8bit):3.5144574650895364
                                                                          Encrypted:false
                                                                          SSDEEP:768:R/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSY83+JRS:RVUidzJCurDGSYvW
                                                                          MD5:EF4508C84A025095B183E6BAD67B1ECD
                                                                          SHA1:D12D5381D50D578AA8687671DC542C462A7F490D
                                                                          SHA-256:6D1B512110BEAF2CD1296AC878F51D567848AB4A1CED4F18C72806BB136B3D23
                                                                          SHA-512:E695E7E6F4A11D5E8D62982E26B69B87DB2F1F3D6B6DCCD5F1DF51879F5C4533265CBD7B785E1F2652D8CA3FC913D4F862E7575F67C636314A6E6956FD96E023
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp932, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp936.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):134671
                                                                          Entropy (8bit):3.5217328918779645
                                                                          Encrypted:false
                                                                          SSDEEP:1536:+CwDua7D90Jz1aDJmnMfEGniOQdH6prJs3inqlW6/t9Qwf+zCt5:j1WVRpe3rpt9hf+Gt5
                                                                          MD5:CF9CFD6329A4FB6C402052B9417DAC3A
                                                                          SHA1:75CE13FE1E5898D47B67F951C0C228851F1CC04D
                                                                          SHA-256:B6EC2BE0504CA62B9D1B6857F6BAA13FFAC5A567D4432F4EAB98ADC830F5D9C3
                                                                          SHA-512:7E19607EEA5342ECFE92D56DAAE82827DE147AE5AFDA8E9D67FD0970F528902CDE20A8A07CF2F341B926E59BB4FF792872976F1C7C5CD351959A71A8B6A1924A
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp936, multi-byte..M..003F 0 127..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp949.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):132551
                                                                          Entropy (8bit):3.100976362851161
                                                                          Encrypted:false
                                                                          SSDEEP:1536:2UO8ecy5KnSMsDlOmNpkQ4oQHnTApv+ngLbiyEY:2U/etc/sBRZp//r
                                                                          MD5:03E19A4DE3490A7DC50D04EC1F558835
                                                                          SHA1:9DFECAE08C98109EAA358F5920AED647888F722B
                                                                          SHA-256:477F8B79B67F4A22C963EE65B9B387DBD8E4B8F62D800B0A51D2276580C6ADBB
                                                                          SHA-512:7D6AD30AF75A3AA6332A860C6ABF87BF725EB6B4AF3B37699043A10EF3235471C63D0ECB4D437D5AD9438DF5DA646EB55117A9BB8B55EF6868F71E49035C18B7
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp949, multi-byte..M..003F 0 125..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\cp950.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):93330
                                                                          Entropy (8bit):3.319807723045599
                                                                          Encrypted:false
                                                                          SSDEEP:768:aAHU3LIkZlmXrd/uQ0ao98ggKSTEvZPHb6qRL5NpiadDp0ZBFR6YR/fW:aVduBGf9PgFMT6q95GDRBfW
                                                                          MD5:1D84B025DAB127F2073947D764D307B6
                                                                          SHA1:4E3D3CBD96D084836F1FE6F2AA497E3FAA463B9B
                                                                          SHA-256:F80E05533D1A1494C32F9412E9AD2D9C11FAF9AE0668A6F9D1FA5CEEDC6870E2
                                                                          SHA-512:188D649F9717F20524AFF47F85C3B23AEC3E7825BF54975285D06C17587D581DC24A3F6A7CAB1703DE7AD5521FE2FE2572DE627A81E6A48049A47BB219ED4AF8
                                                                          Malicious:false
                                                                          Preview:# Encoding file: cp950, multi-byte..M..003F 0 88..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\dingbats.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1113
                                                                          Entropy (8bit):3.7780987266961663
                                                                          Encrypted:false
                                                                          SSDEEP:24:vJMHkUlJvRjmf9RCsUBOdXsCbbNviANpk3m1XFAoE4xSF5HrBPkdn:vKvlA9RCs6CXrViAN51XFA9eSvdPKn
                                                                          MD5:90FE0C57BBC6C2D8A3324DEB7FD45F3D
                                                                          SHA1:06B95BE43E4C859A0F1B01384EDD26500C6C1F9E
                                                                          SHA-256:EB9B262E4D179268E6F017C0D4EF0E7034E31A5B4893595D150640CA1F6A1C45
                                                                          SHA-512:6A5E67D9F3EC6046C42793E1437B8A6E50EBD72D8EC67FEFEB6DAD6FAB6A5B5C74F939363587D5A6529E217AF54FB8A9CF0F768E114DD931C57887451CACE56E
                                                                          Malicious:false
                                                                          Preview:# Encoding file: dingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A327A

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\ebcdic.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1073
                                                                          Entropy (8bit):3.0039861897954805
                                                                          Encrypted:false
                                                                          SSDEEP:24:XXBcIhJZDgEoQkNCGz0Jyh9lZk3Vmd2QhZLXPiALV3d:dTcNCJEhfZk3Vzox/iqVN
                                                                          MD5:F7B3771D43BDE6AFF897683BED2FE6AD
                                                                          SHA1:E70C2C0902413536CB6163752D70F3AE4AF6A967
                                                                          SHA-256:165BE658AB7D61FFC3DF1E2F1438C2F9FCEE6808A756316302157F44E6D3ACD7
                                                                          SHA-512:F87DC718EB2DD95237B144FDA090BB636121B9479E492AC94E4F7EBDD88171F070B9E9F6165BDA7B7E2BA2A3E6188B1108D8F91AA5F142CCCFDAD317628DD941
                                                                          Malicious:false
                                                                          Preview:S..006F 0 1..00..0000000100020003008500090086007F0087008D008E000B000C000D000E000F..0010001100120013008F000A0008009700180019009C009D001C001D001E001F..0080008100820083008400920017001B00880089008A008B008C000500060007..0090009100160093009400950096000400980099009A009B00140015009E001A..002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C..002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F..002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F..00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022..00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1..00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4..00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE..00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7..00F900410042004300440045004600470048004900AD00F400F600F200F300F5..00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF..00D900F70053005400550056005700580059005A00B200D400D600D200D

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\euc-cn.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):86971
                                                                          Entropy (8bit):2.3925661740847697
                                                                          Encrypted:false
                                                                          SSDEEP:768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
                                                                          MD5:C5AA0D11439E0F7682DAE39445F5DAB4
                                                                          SHA1:73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
                                                                          SHA-256:1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
                                                                          SHA-512:EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
                                                                          Malicious:false
                                                                          Preview:# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\euc-jp.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):83890
                                                                          Entropy (8bit):2.350315390677456
                                                                          Encrypted:false
                                                                          SSDEEP:768:2GhX8nuQ635vlHptHzh0abNQPQA0OMS2HhFV3:2GikvRpMuNQ4P73
                                                                          MD5:F2DE0AE66A4E5DD51CC64B08D3709AAB
                                                                          SHA1:97558A51A6DD6C56FC7A42A4204141A5639021FD
                                                                          SHA-256:A3C916BA16BCAC9FAA5A1CCC62ACA61452D581CD8BA3EE07EC39122C697274C9
                                                                          SHA-512:0EAA90100527FF150D2653D7BB57647D69E592BE53B714DDD867114CFCC71E3A76882772F4FAECE040DF09FA8971D1C22DECC497E589B4CA827A6890497A48D9
                                                                          Malicious:false
                                                                          Preview:# Encoding file: euc-jp, multi-byte..M..003F 0 79..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D0000008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\euc-kr.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):95451
                                                                          Entropy (8bit):2.4080588863614136
                                                                          Encrypted:false
                                                                          SSDEEP:768:4/vO7UlClqAd8XfpUqv+mCoKRuLbtMjnIxz0DY:4nO4N9fpv+ngLbiyEY
                                                                          MD5:103843B3A57168BD574F6CACC550D439
                                                                          SHA1:982652EA2B0DCFBB55970E019A4EDFBFCFAF9C24
                                                                          SHA-256:5448643398685456A11CBB93AF2321F70B8659E2FFF3CCC534B4D53BD2F38C89
                                                                          SHA-512:27A8DE6F97DB4A96E5D0132692A32A99DAB8A6C98973A0C4E50A219F2D2F364E63D657E5E8478B2706CA33C45C376F55B5BFCC9459E06AEA88BFCD4F0E32525C
                                                                          Malicious:false
                                                                          Preview:# Encoding file: euc-kr, multi-byte..M..003F 0 90..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\gb12345.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):88033
                                                                          Entropy (8bit):2.3790651802316996
                                                                          Encrypted:false
                                                                          SSDEEP:768:o4Is/C+0IwpRK1CkinIKUyNiNBzxOC4T/:LIsR0/RKckiIgNiDtOxT
                                                                          MD5:1A8E55DEA98B6D5EAC731ED233D3AD7C
                                                                          SHA1:1335FC0FC2AAE7E7F5EC42AC17A4168368B4A64D
                                                                          SHA-256:B4894AEDD2D5B5AE54B6D2840F7C89A88E9308EFD288F179E65936E172EF4B0D
                                                                          SHA-512:9DDCE366BA1196EB9FB913ACFDE8516BC9BB8D51894866D2E7E8CB313DC4D6C6D33C5A9E78142E83594DC423D10DA6F8DE211E69844B939198BC7DB9AED808F0
                                                                          Malicious:false
                                                                          Preview:# Encoding file: gb12345, double-byte..D..233F 0 83..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\gb1988.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.270324851474969
                                                                          Encrypted:false
                                                                          SSDEEP:24:qrmHVBUlJvRj76OVbusZhAMiZyi77qN8VmKfkiJt0RMFS:qSMlZVnrAMiwMmNPYPFS
                                                                          MD5:D06664ACAA478BDEB42B63941109A4E3
                                                                          SHA1:4A6196FCC1BDE988C1A23EAA69745A9979F1AEFF
                                                                          SHA-256:ACD50951F81566C8D823670F9957B2479102EB5AE4CF558453E1D8436A9E31FF
                                                                          SHA-512:CB51A36B851FFDB5C6F9B9D0333EEA6A14CEF3796E0A60530198C16999D64E638047E873333630360299C9126F79CEDDA2D9F169028CED1FC04B1D3C55FFFC5B
                                                                          Malicious:false
                                                                          Preview:# Encoding file: gb1988, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..002000210022002300A500250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\gb2312-raw.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):85912
                                                                          Entropy (8bit):2.3945751552930936
                                                                          Encrypted:false
                                                                          SSDEEP:768:D47/S+i8vdx3Tz+hpHcBrQqKtrebjMIGCx8jE:0c873T6DHcBrbKtrVlE
                                                                          MD5:9357E05C74D6A124825F46A42B280C14
                                                                          SHA1:E5106ABE12D991AFE514F41E3B9E239202A4ADFE
                                                                          SHA-256:C445E4C9F676AE997D2DDA2BBC107B746F3547D85F39479951C56F46275EE355
                                                                          SHA-512:B2187D70A92FB38572BA46F3C3443233BEED1A4ABBFBA1B860F4BBAE6B3D8C16B8C9F52A20DAA12B2B8B40972E52F816860427B743530177E4CF0D8BA34EF381
                                                                          Malicious:false
                                                                          Preview:# Encoding file: gb2312, double-byte..D..233F 0 81..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\gb2312.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):86971
                                                                          Entropy (8bit):2.3925661740847697
                                                                          Encrypted:false
                                                                          SSDEEP:768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
                                                                          MD5:C5AA0D11439E0F7682DAE39445F5DAB4
                                                                          SHA1:73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
                                                                          SHA-256:1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
                                                                          SHA-512:EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
                                                                          Malicious:false
                                                                          Preview:# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso2022-jp.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):4.949409835601965
                                                                          Encrypted:false
                                                                          SSDEEP:3:SOd5MNXVSVLqRIBXS4ovLE9sDXMVyXK9ow1Deq9Ts5dRPMSXcRA0kcR4X9cL+TXI:SVNFS0oyisLMsXK9okTw/BDSVKNw
                                                                          MD5:D3AC33390D31705FA4486D0B455247DF
                                                                          SHA1:2EE8613DC04A6FA84AB38FD5F3A2AA3FE330625B
                                                                          SHA-256:98074C85650A420A095ADA9138DA3A8A0AA4027BE47EA1E97A596F319EB084E9
                                                                          SHA-512:CB265B753C84968E2D1D6E706906DA9A7BB796D08F626290BCCA8F089771AFD176A9DC912773E8BA390D2AEC08592AD535C7D254E1DF92CF04848601481D4EFE
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso2022-jp, escape-driven..E..name..iso2022-jp..init..{}..final..{}..ascii..\x1b(B..jis0201..\x1b(J..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso2022-kr.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):122
                                                                          Entropy (8bit):4.978693690727393
                                                                          Encrypted:false
                                                                          SSDEEP:3:SOd5MNXVTEXIBXS4ovLE9sDXNvdwUHEQwqc6XWxVUNOov:SVNFSoyisL/Zzc6mYNHv
                                                                          MD5:057CB0AA9872AC3910184F67AC6621BC
                                                                          SHA1:BBA47F9D76B6690C282724C3423BD94E2C320A04
                                                                          SHA-256:234811FC8B0F8FF2B847D9CC3982F1699DF1D21A43C74DCE45BA855D22520007
                                                                          SHA-512:019F187D2D16FB51BF627ACB7E67778857E56D4C160E0E5ACA6ABC05EC5FDB624CE2715CB9E0DAD73BFF9D697982BE0D539BC55BCCD368FC7C8EE0FFC04E9F61
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso2022-kr, escape-driven..E..name..iso2022-kr..init..\x1b$)C..final..{}..iso8859-1.\x0f..ksc5601..\x0e..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso2022.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):240
                                                                          Entropy (8bit):4.95909788984399
                                                                          Encrypted:false
                                                                          SSDEEP:6:SVNFUXoyisLNcs9ozc6W4Twk0sRBDSVKN6tWIHRy:oUYcLNcTzczbwRYRy
                                                                          MD5:BB186D4BE3FA67DD3E2DEE82DD8BD628
                                                                          SHA1:93CE8627038780CFFF8C06E746DD5FB2B041115C
                                                                          SHA-256:741B4C842557EED2952936204D0AE9C35FA3A0F02F826D94C50C46976291797C
                                                                          SHA-512:4921E7AA3DB8E33609603FE129B97275DFF80CFB06648D2068FA7950246C67B9B530B74827638F69F4DFB8F55CDD4AA952EA72EAEB6ABB527D52F20C6B46FB51
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso2022, escape-driven..E..name..iso2022..init..{}..final..{}..iso8859-1.\x1b(B..jis0201..\x1b(J..gb1988..\x1b(T..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..jis0208..\x1b&@\x1b$B..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-1.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):3.236046263464657
                                                                          Encrypted:false
                                                                          SSDEEP:24:iyHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkL+rSMH+tKv:iyMlBVnrAMiwMmTmokLz0
                                                                          MD5:3538A970CD098BF5CE59005FE87B6626
                                                                          SHA1:285A96CC40D7CCE104FB4B407C7F0C400AA8F9CB
                                                                          SHA-256:A9CB4F4CA111608F882729BC5EB1C2F15530C515EF02DD2CA62F2D8DC5A210CF
                                                                          SHA-512:A6A6F2D8B5C22E240D195D168A604887062508FF3340D24E13BFCBD6C2E687347F2CFE724FA2ED12F36915B55EE2CFD901EC3F08E2B0A2FFD3BC2A98BBD12A50
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-1, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-10.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.319750415373386
                                                                          Encrypted:false
                                                                          SSDEEP:24:jHVBUlJvRj7SOVbusZhAMiZyi77qimXG2yM6q7KytC:jMlBVnrAMiwMmTXG2gytC
                                                                          MD5:CBDE40170FECD2496A9DA3CF770FAB7B
                                                                          SHA1:3E1D74DF6AFEB6CDE8ECBDAC8F81F2F9C64150DE
                                                                          SHA-256:48F4A239C25354F0E9F83A39F15D4632BB18A9C33E60C671C67307159917ECED
                                                                          SHA-512:A26B56A4CFE29E5A0A0B3A55283A7767397693388E2DEEC342C69B6F718FAE2407EB8D5ADE538FAE6947CBB8B052943C3A52F2D046ABAC7A3DAA86D730DC293F
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-10, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A..00B0010501130123012B0129013700B7013C011101610167017E2015016B014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF..00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF..010100E100E200E30

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-11.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.3206399689840476
                                                                          Encrypted:false
                                                                          SSDEEP:24:6HVBUlJvRj7SOVbusZhAMiZyi77qimwHmEU4AyqU+TWwdd:6MlBVnrAMiwMmTf4AyqUSd
                                                                          MD5:E2A0BCB83BFC3F435CDCFC20D5CF2E0C
                                                                          SHA1:CFD18B5B5DB4EE46E63D912B8FD66D513C4C8D39
                                                                          SHA-256:21E769C5A66E4D12D6E7DB24022E92AF1EC0D0331FE3C8C605654F239C0F3640
                                                                          SHA-512:C86F9180F2F4A177F1EA10E26B0903ABEAFDDE0317C332A48F8D1BB586DAC91C68800E2E4FA2CD739C435419B106CBA4BEFC049F2BCD720E9FC2C0AE8436CFAC
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-11, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-13.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.338879965076632
                                                                          Encrypted:false
                                                                          SSDEEP:24:olHVBUlJvRj7SOVbusZhAMiZyi77qim2w4kBUioGnd2:olMlBVnrAMiwMmT/WNI2
                                                                          MD5:21CEBB723D47B1450A7FB21A82470B97
                                                                          SHA1:A40FD3AFE1ECE89E3F682D527D281BC563DB3892
                                                                          SHA-256:3271D39D7B4DCD841E8E5D5153D1B8837718B88FEFEC73DC37D314816EEFE5E5
                                                                          SHA-512:3A0E033A4D93C679215F672C6C4FE425D63E1DE157AA671E7400639165EC3EB498E4EEB030D6FB8FF8BE2FD8C986D341036A8CED9FA094D092CF2822D5DC065B
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-13, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F010101070

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-14.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.3670559016263915
                                                                          Encrypted:false
                                                                          SSDEEP:24:vHVBUlJvRj7SOVbusZhAMiZyi77qimhw6COlk1fKMH+tiH:vMlBVnrAMiwMmT/tlkQz0
                                                                          MD5:FDAA88946DE4EB4E6D37F2B6AFCF6CAF
                                                                          SHA1:56FC4773941E7457EA04EDA92C883642DE45D100
                                                                          SHA-256:F0A5675027FB1CA34B4E4128D24C2968CD275890569A32A86AFA4994CE4983E0
                                                                          SHA-512:92658A6FEB42A41B3CFFC377C4A9A3F6780A79FC596D3FEDBA6D3B3D75A9F40E859A2CE8DC579A278BAEEDEEFA2408E2B7853D99D5C2D14AACF63C521FE2BB86
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-14, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178..1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF..00E000E100E200E30

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-15.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.260398494526282
                                                                          Encrypted:false
                                                                          SSDEEP:24:mHVBUlJvRj7SOVbusZhAMiZyi77qimmRf4kL+rSMH+tKv:mMlBVnrAMiwMmTmCkLz0
                                                                          MD5:D779D5E2A0083C616A226B2D82ABF0EB
                                                                          SHA1:D1657DB5E2989EBA80BAB98A1E1217CFFFBB19DB
                                                                          SHA-256:C74E8E23A0FF0D5DEA7C318CA20DC817DA4E57B0DD61B3361FC0D5098A9316FE
                                                                          SHA-512:26E62BE8AE793ED3B725BF0D1BABF4D6ED63A6F3772ABD48955FC4394BDE5A47614D1FF89A21A828676BF1302F3C9361B557B0FBF0DF8561FB7E66542FE94CDC
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-15, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF..00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E30

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-16.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.3065938185320918
                                                                          Encrypted:false
                                                                          SSDEEP:24:dHVBUlJvRj7SOVbusZhAMiZyi77qim0SmmPkYTtyL:dMlBVnrAMiwMmTttPkYpyL
                                                                          MD5:74FDEDDAF670023DA7751FB321E345A0
                                                                          SHA1:0677FED67C1333A9A74D50642E5214701A57E2AF
                                                                          SHA-256:640D977EC1D22B555C5075798DA009E3523E8F55F29BE22A3050CD1B4EF7B80E
                                                                          SHA-512:AC02FD95159A856A9DDEF4E6A8216B958DC07311B553FF39403DC5B77E1AFF2A2C4C03F5F26A2BB7AD5DB6800BEE03E895554556DBBFBE89426286796ADE55AC
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-16, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B..00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C..00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF..0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF..00E000E100E201030

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-2.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):3.340505173539446
                                                                          Encrypted:false
                                                                          SSDEEP:24:UHVBUlJvRj7SOVbusZhAMiZyi77qim/ssm5VO6ys2K:UMlBVnrAMiwMmT/ssYTys2K
                                                                          MD5:9B87850646FFE79F3C8001CBCB5BB3A1
                                                                          SHA1:8F97576F3FB3B5DBEF71DC2C9314AB5E530974D6
                                                                          SHA-256:76949B03F57041B07F41902BD7505AB3594D79AA8F7BDEED5F0481004B10CBC3
                                                                          SHA-512:101A28AF0799E7E0A5723E5DD76D5EF0FEEF584AC479A88F499CB3B7D2AA93767D72F8E51C76F7547F08FF8DD3CBBA7FF444BD07F99A92755526E75C596109EF
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-2, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B..00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C..015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E..01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF..015500E100E2010300

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-3.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):3.2507537230559977
                                                                          Encrypted:false
                                                                          SSDEEP:24:tHVBUlJvRj7SOVbusZhAMiZyi77qimw2g0kgTJMkFtoD:tMlBVnrAMiwMmTo0kgTJDoD
                                                                          MD5:CBD0B9CDCD9BC3D5F2429A760CF98D2F
                                                                          SHA1:6DEF0343E0357E0671002A5D2F0BFC2E00C8BCF9
                                                                          SHA-256:1F51E7BDA64D466C16FEE9A120BBE3353A10CEB9DAB119FFA326779BA78D8C5D
                                                                          SHA-512:88DB6D23B53F4A78133C794ED42FA3F29A4ABAD35DE4B022040FA187AA59B00664CC13F47AFF4507D72F4CB2166F026144213EE760AB0FD67CDD2FA5906F434A
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-3, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B..00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C..00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF..000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF..00E000E100E2000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-4.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):3.3413832766873073
                                                                          Encrypted:false
                                                                          SSDEEP:24:KHVBUlJvRj7SOVbusZhAMiZyi77qimX4AsD/njR7Ky8hA:KMlBVnrAMiwMmTXBs3EyuA
                                                                          MD5:8B620EDECAC2DF15A024C2CE15FB64A5
                                                                          SHA1:65C5EE5D08964E37393E6A78ABA0DB16D51240E2
                                                                          SHA-256:66B3CF994F0B5E0103D13E812958320AFB555C91E3F81B579D4CBF231E6A0805
                                                                          SHA-512:93391325405D3AEA0A913F5EA8EA0391920D10F234C26AB1DA70992702889A3AF7B85E11A1FCA554690942B238CE313DD460798E59C5B1F4069036E7B0F24F44
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-4, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF..00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A..01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF..010100E100E200E300

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-5.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):3.342721205983665
                                                                          Encrypted:false
                                                                          SSDEEP:24:zHVBUlJvRj7SOVbusZhAMiZyi77qimq5+SAJlz9aRme3cJbx:zMlBVnrAMiwMmTqeYnsJbx
                                                                          MD5:6FBEFDC3DEC612B7B2CC903D8C53F45B
                                                                          SHA1:14EC3C166DC411149C32C262DBE8E327F6186669
                                                                          SHA-256:3130BF26DA0C840C1E02203A90C3B1C38966FB203130E2FBB3DD7CB3865A3539
                                                                          SHA-512:F3F15AD8B6C9D9B4C9C994FE3235B4463E59BE7DCE79CF3F7AA77905D6F4DC2C4AABB79B440767DB13D357B13F09EA34983FCA7BC92D0AFA15FB6CBEDDD04E38
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-5, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0040104020403040404050406040704080409040A040B040C00AD040E040F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..044004410442044304

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-6.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):2.992219341429816
                                                                          Encrypted:false
                                                                          SSDEEP:24:YHVBUlJvRj7SOVbusZhAMiZyi77qimEZjyG/KE:YMlBVnrAMiwMmTEs6KE
                                                                          MD5:52F025D943A45EE840D9C3DFD06E4D79
                                                                          SHA1:571EA14B49FA6150BFD2ABA79E52799955D9FA10
                                                                          SHA-256:CB71909BF01A3A7A4C7396359DA06D206B58A42AD68192CE37169D6640D46E13
                                                                          SHA-512:77FF9DC785A63CA59A7D58BB25C7D2C16F364E525F9B939177385EF80F7DE37734C8774F1BC829CF0270FD66257A4D31689654C8037DB0A86A0291FFDE637B90
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-6, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000000000000000A40000000000000000000000000000060C00AD00000000..00000000000000000000000000000000000000000000061B000000000000061F..0000062106220623062406250626062706280629062A062B062C062D062E062F..0630063106320633063406350636063706380639063A00000000000000000000..064006410642064306

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-7.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):3.393893260854861
                                                                          Encrypted:false
                                                                          SSDEEP:24:TMyHVBUlJvRj7SOVbusZhAMiZyi77qim2OBHK9QQSqiWeIDDdn:TlMlBVnrAMiwMmT1hKyQSqiWeIVn
                                                                          MD5:4BFB0A35D971A9D4C5EA8D8099E93C37
                                                                          SHA1:8FED2CBB1343E5B4442748242B5F89A76110592D
                                                                          SHA-256:76F6BC85FC9CB89BC3F94D36275AB23C740BA17FD36EC8907479DA3A885415EA
                                                                          SHA-512:C9CE1E9EA57A1DEF62BBC60A115C06325C6EE8F92021695459E1ADAF1193A559BC5F0229191BFC2E344296DC137583ED4A9A61A65890F99F4CF97B3864C7AF0F
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-7, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A02018201900A320AC20AF00A600A700A800A9037A00AB00AC00AD00002015..00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-8.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):3.0494739426493567
                                                                          Encrypted:false
                                                                          SSDEEP:24:uHVBUlJvRj7SOVbusZhAMiZyi77qimieGlnvs26Kcv:uMlBVnrAMiwMmTirv87
                                                                          MD5:5F69EAF54E7A1E8AC81C9E734DBE90D8
                                                                          SHA1:BA509C88A4FC03922EF5CDC887FAA7B594A9BC5A
                                                                          SHA-256:865E3665743B5FABA3E1AD6AA55515A666BD05DA6266879D9B66C98905DAFF3C
                                                                          SHA-512:D9924FBE59CB571AF721CA602DBE58CAD0D9310610EDF544F8FC0FBF3D1CE4E99597D0198E4E7C802107012786346FE4C1B9C6C3A76D5F60B9A83981B0EDA24D
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-8, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000002017..05D005D105D205D305

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\iso8859-9.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1114
                                                                          Entropy (8bit):3.2591070910715714
                                                                          Encrypted:false
                                                                          SSDEEP:24:XHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkBSMH+tA/b:XMlBVnrAMiwMmTmokgzAD
                                                                          MD5:0B99E605E73B7D8DEFD8D643F5729748
                                                                          SHA1:F30E7CCBCD9C539126E8D6CA0886E4B2BD54E05D
                                                                          SHA-256:CF51E867DDE2F19553D98FEEC45A075C4B4F480FB1EDADB3D8DAD1EBEA9299F3
                                                                          SHA-512:DA0487CD7F2143195E80697C17FFDB61AFD464C888DDF84813B2B5D1BAB24D96466DA7A7F77C8E4A9D0D53F34D72928923380AFC1B92A96C0A3BFF46006A4E19
                                                                          Malicious:false
                                                                          Preview:# Encoding file: iso8859-9, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\jis0201.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1112
                                                                          Entropy (8bit):3.2708615484795676
                                                                          Encrypted:false
                                                                          SSDEEP:24:zBHVBUlJvRj7SOVbusZhAMiZyi77qN8VmKfkiJt0RMFS:zBMlBVnrAMiwMmNPYPFS
                                                                          MD5:4E21F24F8D9CC5DF16B29CACD997AC69
                                                                          SHA1:064E723EFB82EF1C303E5267496304288821E404
                                                                          SHA-256:61B14A7C312366F79BB45F02C6B7EE362E6F51CBAD5E479E563C7F7E785DB654
                                                                          SHA-512:AF8FAEB47EFB51F2537139F7C4254ABED119E477FD2B5E83B90B7A903B43C4E02DDF43A7DDB044A0A9601E9F9ADE91B02EE7C0EC87FF5DDCF9951B9601A90435
                                                                          Malicious:false
                                                                          Preview:# Encoding file: jis0201, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..00000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\jis0208.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):81772
                                                                          Entropy (8bit):2.3571626869060776
                                                                          Encrypted:false
                                                                          SSDEEP:768:AigXM6CwL/9pV7Hl6+Yko9gZxErA3/MS/8xqg8:AZ/tp1Hl2KZxUfr8
                                                                          MD5:F0661E22C7455994AA1F6EC1EDA401B4
                                                                          SHA1:928B2AC46A9FDE61A81F56BE225E6138B40C22E5
                                                                          SHA-256:F6B1C6AC5F5FC4E990A7A1AAC16A406012040936431BEFE7D2B6CD1DA9E422C4
                                                                          SHA-512:917CC58678A9E9F5CBE860D30828846ABA4EA8CDFAB7DD1AE6A66C47ECBB85CF67DD97BC3E6F95341DD30F4E757B2CEA571708D5B4CED18A29F19904C3138AE0
                                                                          Malicious:false
                                                                          Preview:# Encoding file: jis0208, double-byte..D..2129 0 77..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8..FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F..FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D..FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7..00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5..FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\jis0212.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):72133
                                                                          Entropy (8bit):2.3455261548208055
                                                                          Encrypted:false
                                                                          SSDEEP:768:9F/D7CH2puD5CdzU3nAkP5dHn7s391fmOarFaVQ:H/D7CHbozU3nAk3H7sXm3FgQ
                                                                          MD5:07CE2C135BE17DBAFA558AA5949A53DB
                                                                          SHA1:5D9DBEFCCB44E76C1A4E61360C6FCED8DCC8EF4D
                                                                          SHA-256:785CFC5F5D9CB06DB8061730AB0016A0F70D0B59F6787D2A3CBB8D5779C99706
                                                                          SHA-512:E954D7198D58ACEDEB4C8E5F466107767C3DA43763A5F6CDDFCF567226F9B22B4C2DE27564F28CD125D7F1BA7CB9C6DE6DEC4065EC2676572C793BE458FDDD9D
                                                                          Malicious:false
                                                                          Preview:# Encoding file: jis0212, double-byte..D..2244 0 68..22..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000000000000000000000000000000000000000000002D8..02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000..0000000000A100A600BF00000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000BA00AA00A900AE2122..00A4211600000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\koi8-r.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.531149521168141
                                                                          Encrypted:false
                                                                          SSDEEP:24:KcJ5mHVBUlJvRj7SOVbusZhAMiZyi77qpSzIa9qVRS3YcEchJh3MAxSl:KmmMlBVnrAMiwMmAzIxVgBE6cAxQ
                                                                          MD5:96F54CC639ACA8E466FB8058144C9350
                                                                          SHA1:0B9530D6080F2BAACABD5AA0D48BFF316FCCEF64
                                                                          SHA-256:0E43244BFC4F33FACB844B9E00270A1A4C24DC59B8A9B95104E2D788BB2F59FD
                                                                          SHA-512:5B7859325E5E34C9D4558B1198795BB9C6A8EF783EB97193EA80BA76C38AFE9BDD1B526B77401DF5456B7A0E85E942191FFD4B4F2B9F0C8168A7093EE452802E
                                                                          Malicious:false
                                                                          Preview:# Encoding file: koi8-r, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204512553255425552556255725582559255A255B255C255D255E..255F25602561040125622563256425652566256725682569256A256B256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\koi8-u.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.5076564572101714
                                                                          Encrypted:false
                                                                          SSDEEP:24:K+HVBUlJvRj7SOVbusZhAMiZyi77qpSzIaU3dmVRS3YcEchJh3MAxSl:K+MlBVnrAMiwMmAzI/EVgBE6cAxQ
                                                                          MD5:4B755EF2288DFC4009759F8935479D68
                                                                          SHA1:C3BDF0D9DF316DE8919DAA4329275C5AA81D61B4
                                                                          SHA-256:ED04D5B977B8C8944D8760B713FF061292DA5634BCBB67CDFB1C3A6FF5378C81
                                                                          SHA-512:3F1E1CC47327054FB9C54157ED10514230F10BFCD4BD9FDAFA02D7B238137DC7442CA2661B0739D8EEA3181E187D3B639A2C8118A0DE272C96000908121B6CFB
                                                                          Malicious:false
                                                                          Preview:# Encoding file: koi8-u, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204510454255404560457255725582559255A255B0491255D255E..255F25602561040104032563040604072566256725682569256A0490256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\ksc5601.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):94393
                                                                          Entropy (8bit):2.4104200953565513
                                                                          Encrypted:false
                                                                          SSDEEP:768:XbjO7Uw6uKdosXRxps9a+ut/BmZPwkpT9A0T03o:XfO4ZBRxpV+4wPwKloo
                                                                          MD5:366C09E4A4CC10006E593F5B3F3461D7
                                                                          SHA1:A0DABFBEEB66E26FB342844EA41772D7A1D19C24
                                                                          SHA-256:9B27FE7E7054F36E279993F19E52E18AC03360D117AE80C42B4E984A97C590AA
                                                                          SHA-512:670F32D698C7992038E736D3AD40098D8589C0C5A1379E32A0F02A02FAF251B1312CAD131DDADC3F80B23A3821A91689F2E310309028BDDDF227D532EB505A20
                                                                          Malicious:false
                                                                          Preview:# Encoding file: ksc5601, double-byte..D..233F 0 89..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300200B72025202600A8300300AD20152225FF3C223C20182019..201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7..00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640..222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6..25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D..221D2235222B222C2208220B2286228722822283222A222922272228FFE20000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macCentEuro.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1116
                                                                          Entropy (8bit):3.4295694929963667
                                                                          Encrypted:false
                                                                          SSDEEP:24:8jHVBUlJvRj7SOVbusZhAMiZyi77qHVPJSf2FcVDu1LEe4qPPMl2J89:8jMlBVnrAMiwMmHEmJ4IMgi9
                                                                          MD5:10850BCFB943318284D6191494EBD7D5
                                                                          SHA1:237D5DDF7969A422991F17021244D13A2BB0DE92
                                                                          SHA-256:81ECA6840B87F2DEF9FCDD171A55C2D71A49386D88401CE927AE57D7DDD7AAAA
                                                                          SHA-512:D797781C228B70D2D83DB8ABA08F840CE49846C9473CC89A2E316900D9E08A63142E68AD9ABBB2EF67BF9F1D392772FAB36CCC09632022A1437AE27C11F2284F
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macCentEuro, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179..017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC..202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E..012F012A22642265012B0136220222110142013B013C013D013E0139013A0145..0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C..20132014201C201D2018201900F725CA014D0154015501582039203A01590156..01570160201A201E

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macCroatian.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1116
                                                                          Entropy (8bit):3.3992482002374516
                                                                          Encrypted:false
                                                                          SSDEEP:24:8ULyHVBUlJvRj7SOVbusZhAMiZyi77qsTMdKxOZwwL+KR5D/jlJy6QWky:8ULyMlBVnrAMiwMmOsL+KR5DblE85
                                                                          MD5:A60FBDE33D13C732095713D1AB6713AB
                                                                          SHA1:4B0EB443F2D0E4B8DB7D0435F9311E5F9A625123
                                                                          SHA-256:BBE6F5EBB5EAB08C91DF7D524FAF39B03AA8B9F84C67ABA0553A84EC56668CB9
                                                                          SHA-512:3EEBA6BA3FCD875AFBD5DF41EDC21E872416A48D03343232904CC99CAF913045DAF7B1A1ACD0949EF794AD7B6C9AE8F93808423FFC4B67718E732B2FF5D9B6D7
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macCroatian, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8..221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8..00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153..01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB..201300B7201A201E

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macCyrillic.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1116
                                                                          Entropy (8bit):3.4178221849964903
                                                                          Encrypted:false
                                                                          SSDEEP:24:8dHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJY:8dMlBVnrAMiwMm8Y6zUk+UVsJY
                                                                          MD5:C390D66441AC61CCF0A685CA5EE0BC1C
                                                                          SHA1:FCAE825B54400B9D736EF22A613E359E3F0FA6C2
                                                                          SHA-256:76EFE571ADDA7AED467F146CB0BD3A2351F2A720508EA0642C419F5347789CAA
                                                                          SHA-512:C891DB15E0F600965885DE6745EDD2A4E3A6A20CA30A9AAE89CBD8C429F8455C4AF7F2FC053FB3D730D8544AB6A6E78E769DB93DAD7B29868B746FA10373F021
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macCyrillic, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..0430043104320433

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macDingbats.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1116
                                                                          Entropy (8bit):3.870022681111701
                                                                          Encrypted:false
                                                                          SSDEEP:24:87JMHkUlJvRjmf9RCsUBOdXsCbbNviANpkDP1XFAoE4xSF5HrBPkdn:87KvlA9RCs6CXrViANUP1XFA9eSvdPKn
                                                                          MD5:DCE78527E3A7B7CB1DE9EE5FAF12AFC6
                                                                          SHA1:20F4A3F4DB6B3422C04EBB6B21A568E4C173F9C1
                                                                          SHA-256:062E31D48DC33160999074E49205E08C3655DFF91C2C87F254522E6EBCE2DD96
                                                                          SHA-512:627F5FD2F12B341F2D7EE9032946FE057C4AC74D99687178CEA98B3E150307BB6AA2495B0FA46400760D467E2BF589BE31E998E25CE1D1E8465DA61F22047345
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macDingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A3

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macGreek.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1113
                                                                          Entropy (8bit):3.4954458011071323
                                                                          Encrypted:false
                                                                          SSDEEP:24:8dOHVBUlJvRj7SOVbusZhAMiZyi77qJlbaBMD2aSY5us36Ekp1ysOSU2imR:8kMlBVnrAMiwMm7aKPVusqx1ysOJjmR
                                                                          MD5:0CC92F685A4132BE4B030006670D81CE
                                                                          SHA1:13B1074A90055E9EA061A6206A9C004DA29967A9
                                                                          SHA-256:1AABE561B5C944ABD11C293D4ACAC0F3A4A5A9E84A0342D066F4E3E992348895
                                                                          SHA-512:E1AF3D47D681CD68B6063DEC1241631CABE86FE835232FA73D855AC74D0175540D46511282BE7198A67A37970A5D05CDECF55C10424ED9C1413C108F116094D9
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macGreek, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8..00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC..2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7..039100B12264226500A503920395039603970399039A039C03A603AB03A803A9..03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153..20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F..03CD03B103B203C803B

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macIceland.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.3991839018654573
                                                                          Encrypted:false
                                                                          SSDEEP:24:8KHVBUlJvRj7SOVbusZhAMiZyi77qscqMVmOZmk/LYRldjY/g4JyMWG:8KMlBVnrAMiwMmzqi/LYRlYBEXG
                                                                          MD5:747ADBE54D6992467415E322326FA1B9
                                                                          SHA1:5E3967B5DDF3A6DBF07E90ED6B9B9C2F3F3F35FE
                                                                          SHA-256:6FD08CE6FBA521D51E8058DE5C2DBD6583B80306A8BE7D015361F76314E70A35
                                                                          SHA-512:A04B946993985BF1F8FBA3A7A9AD3838F43F8F27F69B1FB1015D9DC8612AAFCE24E30CBC1FCABBDFB359FD487D51F70F18DA0CDA4A87749A2C82309CEB054849
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macIceland, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE..00FD00B7201A201E2

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macJapan.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):48813
                                                                          Entropy (8bit):3.3767502114972077
                                                                          Encrypted:false
                                                                          SSDEEP:768:K/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSJi:KVUidzJCurDGSk
                                                                          MD5:3DCD22325E0194AAD4959C939B1DE24D
                                                                          SHA1:ABEF1372FBDA83714CE29E015D9A198D4B37B21C
                                                                          SHA-256:47007D9EBF4D34C6CE3599E50AFC7C1CF8129B88994DE2C2A857C09003F9CD2B
                                                                          SHA-512:B8ADFD2315EA38E5F7D4DED219759380069AAB539F1B5AAA5626CE32428CBBEB5E8215AD8351E023BCF72FA4DC30AB40CF59D6D45E33B6D1A6B41BEBFD4BD4C2
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macJapan, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macRoman.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1113
                                                                          Entropy (8bit):3.4060725247347516
                                                                          Encrypted:false
                                                                          SSDEEP:24:8THVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldjBpmg4JyMWG:8TMlBVnrAMiwMmOi/LYRlTsBEXG
                                                                          MD5:34691FADC788B85D98F63159640C7DD0
                                                                          SHA1:C8B3D084D3E831EFF6ECEF71B2029545F214C3D4
                                                                          SHA-256:C83D971D6BC0284EF323C197896E38C57A5FF44784E451EC2997EDA70C0DD85C
                                                                          SHA-512:77D5676F9B7AF7FD1D612A1C426889D8F2C0191887E180B78C4AA42202928A1B3078B76BD3C5F5ABB2A5CE1AE913E3CA6EFDE0483D2A2B0EFC173EF25EAE1D67
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macRoman, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02..202100B7201A201E203

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macRomania.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.412326247178521
                                                                          Encrypted:false
                                                                          SSDEEP:24:8tHVBUlJvRj7SOVbusZhAMiZyi77qsTMVZ5OZwYRldj/T9g4JyMWG:8tMlBVnrAMiwMmOA7YRlFT9BEXG
                                                                          MD5:04E25073BFB0019D8381B72F7B433F00
                                                                          SHA1:B63B0AD9F10A44B0DDD12A3BDBCDEB2992D6D385
                                                                          SHA-256:0B805DAF21D37D702617A8C72C7345F857695108D905FF378791F291CEA150F0
                                                                          SHA-512:0514EC054676C15C65B01B02747CDBAD79BC89FD1A24A17797A8729752FB748FEDBE920E7BBFF41A6DA4BA99002E3B8DB674D53E30485DC36F6BF737EAF11702
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macRomania, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E..221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163..202100B7201A201E2

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macThai.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1112
                                                                          Entropy (8bit):3.6062142626989004
                                                                          Encrypted:false
                                                                          SSDEEP:24:88HVBUlJvRj7SOVbusZhAMiZyi77qqJipJwHmEU4AyqU+TpH:88MlBVnrAMiwMmqJ8Jf4AyqUe
                                                                          MD5:06DC6BA6E4A75CD7FF2D7A4248912C61
                                                                          SHA1:23FB16763A8F11EF48E805E4F453C2F812D48FC4
                                                                          SHA-256:A1802A2FEB01B255EC7C17425EEE4525372DF8CE226F4047D149172EB438F913
                                                                          SHA-512:41A487EC5C36C17B2746C5DC770882A836E6E75CF6A14C31595EB211022F0476BD3B953497C447F21554769F127C3A56E5B6EF8FB3C20A8AFF8C67E0CC94359D
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macThai, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899..FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F..0E400E410E420E430E44

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macTurkish.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.422718883614008
                                                                          Encrypted:false
                                                                          SSDEEP:24:8QjHVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldD8g4JyS:88MlBVnrAMiwMmOi/LYRlWBES
                                                                          MD5:4EA94A0DB35BED2081A2CC9D627A8180
                                                                          SHA1:AB2AC3ADA19F3F656780FF876D5B536A8DCE92C6
                                                                          SHA-256:AFB66138EBE9B87D8B070FE3B6E7D1A05ED508571E9E5B166C3314069D59B4E4
                                                                          SHA-512:7888F560D3728732BE1B7DCE49ECB61F3399CEF11191F4116C891E1D147B2A90ED8FB4A5E7B51904A001C47750BD9EB1B15EA5BA5B4EC5D69CDE7704B69529AD
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macTurkish, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F..202100B7201A201E2

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\macUkraine.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1115
                                                                          Entropy (8bit):3.4157626428238723
                                                                          Encrypted:false
                                                                          SSDEEP:24:8TzHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJd:8PMlBVnrAMiwMm8Y6zUk+UVsJd
                                                                          MD5:A5B48D6F2678579CBE6EA094A4655071
                                                                          SHA1:A13A41D530B21CE8443AFD7E811286537C5BA9C7
                                                                          SHA-256:F7E11736C9FF30102B31EC72272754110193B347433F4B364921E8F131C92BF0
                                                                          SHA-512:612F9D528CE940B5CA9E67CB127013A104655207511F4CF39C8696A127E6A8F4867F5603DCFB78C25A55668C6EE70F2997A8D1626F6F1DD44B19260967F17097
                                                                          Malicious:false
                                                                          Preview:# Encoding file: macUkraine, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..04300431043204330

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\shiftjis.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):42552
                                                                          Entropy (8bit):3.5565924983274857
                                                                          Encrypted:false
                                                                          SSDEEP:768:w/RPrUHiJrwWkyY/W2wHiwWnwWOORY+gutSX:wVUid5JCurDGSX
                                                                          MD5:EEB45AF9D7104872FE290D1EC18AB169
                                                                          SHA1:A80CF4EA46301F0B8B4F0BC306270D7103753871
                                                                          SHA-256:4A15ED210126BCDAE32543F60EB1A0677F985F32D49FCE923B9FAE8C5BCF3DA4
                                                                          SHA-512:C359042B04441AA50E536B23EEA0C6C7B2C1893DFB9CDB5459D3B46945D3BB50FD7A32A4F4E26A83622E76D3D2BB0DBBC3D1F3FB87AAF40520A243165B82AB34
                                                                          Malicious:false
                                                                          Preview:# Encoding file: shiftjis, multi-byte..M..003F 0 40..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086008700000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\symbol.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):3.73983895892791
                                                                          Encrypted:false
                                                                          SSDEEP:24:SdHkUlJvRjvRV7ZQsoRmSds2AsSemxUs+Jw1Viv6ObTXyn:avlJV7ZQsoRmosGSPxU/JOm6wTXyn
                                                                          MD5:D59E748D863A5FAEF0CEEC2564E041A3
                                                                          SHA1:4FFF3BE37F50C090FFC581F1C7769E20281E90C3
                                                                          SHA-256:9660537A7B62996478555C6F57C1962C78FB3972F19370B2E395C44842818A1F
                                                                          SHA-512:BF8FD0CF1CC55564C46976F53F441B26819ADBA7AB7BB04FF3FF5A313366FC3049DF29A839CCCB05EDEF4A7ECBB49FFCA62518EDA90AF2D7781874A8435073AE
                                                                          Malicious:false
                                                                          Preview:# Encoding file: symbol, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002122000023220300250026220D002800292217002B002C2212002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..22450391039203A70394039503A603930397039903D1039A039B039C039D039F..03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F..F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF..03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..000003D2203222642044221E0192266326662665266021942190219121922193..00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5..21352111211C21182297229522052229222A2283228722842282228622082209..2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3..22C42329F8E8F8E9F8EA2

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\encoding\tis-620.enc

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1112
                                                                          Entropy (8bit):3.0553142874336943
                                                                          Encrypted:false
                                                                          SSDEEP:24:ZlHVBUlJvRj7SOVbusZhAMiZyi77qsDHmEU4AyqU+TWwdd:PMlBVnrAMiwMmss4AyqUSd
                                                                          MD5:467A67DE6809B796B914F5BFF98EF46D
                                                                          SHA1:C62418071A6C9CB0DCE3F67E130BFD2FB7AB0B58
                                                                          SHA-256:50B62381D6EDD4219F4292BFDC365954491B23360DE7C08033E7218A3D29C970
                                                                          SHA-512:BF98305AA7D759A087B9EABDC404714D8DC6B4F1BEED4ED0E1FFE646641E1AECA307673D64CF95FD09546D977B3409D6C04F56DCCA1D6332B0D9B6DD460B77A9
                                                                          Malicious:false
                                                                          Preview:# Encoding file: tis-620, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E44

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\history.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8235
                                                                          Entropy (8bit):4.855903177272536
                                                                          Encrypted:false
                                                                          SSDEEP:192:Hf8PxPu7pUHBpqyzmY5rEk/fvs+AokFlTGHts1H/tsEGZPBtsLIVn++G:H6Pu7ELJTtyli8Ozz+L
                                                                          MD5:8609B624CD3EC63DD02DBF89455C3A9B
                                                                          SHA1:B3E1843E34C38AA668FFDDF435A1A65D55449CA0
                                                                          SHA-256:5123DB837EADF45712EA7D449BC40BFD3E8E16D3D71E7D0CE9A32F164973D767
                                                                          SHA-512:B20B75473F34209888F38EE570B8A96061760E88466DFC2EC55C814968DC7F67D92D255E8635188B60455B88F2D1D517747613AD0F366D60412D2D6ECE231B0E
                                                                          Malicious:false
                                                                          Preview:# history.tcl --..#..# Implementation of the history command...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.....# The tcl::history array holds the history list and some additional..# bookkeeping variables...#..# nextid.the index used for the next history list item...# keep..the max size of the history list..# oldest.the index of the oldest item in the history.....namespace eval ::tcl {.. variable history.. if {![info exists history]} {...array set history {... nextid.0... keep.20... oldest.-20...}.. }.... namespace ensemble create -command ::tcl::history -map {...add.::tcl::HistAdd...change.::tcl::HistChange...clear.::tcl::HistClear...event.::tcl::HistEvent...info.::tcl::HistInfo...keep.::tcl::HistKeep...nextid.::tcl::HistNextID...redo.::tcl::HistRedo.. }..}.....# history --..#..#.This is the main history command. See the

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\http1.0\http.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):10066
                                                                          Entropy (8bit):4.806771544139381
                                                                          Encrypted:false
                                                                          SSDEEP:192:kipkqA3KsZMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsZ8kGJ4kIWPaDFzTd
                                                                          MD5:C2092F8CA2D761DFA8C461076D956374
                                                                          SHA1:90B4648B3BC81C30465B0BE83A5DB4127A1392FB
                                                                          SHA-256:8C474095A3ABA7DF5B488F3D35240D6DE729E57153980C2A898728B8C407A727
                                                                          SHA-512:09CE408886E2CEADDF70786A15D63AF9A930E70CAC4286AC9DDD2094C8EDCF97A2ADC2D3D2659B123F88719340D3B00D9F96E9BC7C8B55192735C290E7D24683
                                                                          Malicious:false
                                                                          Preview:# http.tcl..# Client-side HTTP for GET, POST, and HEAD commands...# These routines can be used in untrusted code that uses the Safesock..# security policy...# These procedures use a callback interface to avoid using vwait,..# which is not defined in the safe base...#..# See the http.n man page for documentation....package provide http 1.0....array set http {.. -accept */*.. -proxyhost {}.. -proxyport {}.. -useragent {Tcl http client package 1.0}.. -proxyfilter httpProxyRequired..}..proc http_config {args} {.. global http.. set options [lsort [array names http -*]].. set usage [join $options ", "].. if {[llength $args] == 0} {...set result {}...foreach name $options {... lappend result $name $http($name)...}...return $result.. }.. regsub -all -- - $options {} options.. set pat ^-([join $options |])$.. if {[llength $args] == 1} {...set flag [lindex $args 0]...if {[regexp -- $pat $flag]} {... return $http($flag)...} else {... return -code er

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\http1.0\pkgIndex.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):746
                                                                          Entropy (8bit):4.711041943572035
                                                                          Encrypted:false
                                                                          SSDEEP:12:jHx5XRsLzhjJS42wbGlTULuUAZb3KykszLl7+HkuRz20JSv6C3l5kMn:bHRsRJS42wbGlTUcZ+yk2Lli1z2jxXkM
                                                                          MD5:A387908E2FE9D84704C2E47A7F6E9BC5
                                                                          SHA1:F3C08B3540033A54A59CB3B207E351303C9E29C6
                                                                          SHA-256:77265723959C092897C2449C5B7768CA72D0EFCD8C505BDDBB7A84F6AA401339
                                                                          SHA-512:7AC804D23E72E40E7B5532332B4A8D8446C6447BB79B4FE32402B13836079D348998EA0659802AB0065896D4F3C06F5866C6B0D90BF448F53E803D8C243BBC63
                                                                          Malicious:false
                                                                          Preview:# Tcl package index file, version 1.0..# This file is generated by the "pkg_mkIndex" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}]..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\init.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):25633
                                                                          Entropy (8bit):4.8854383645737895
                                                                          Encrypted:false
                                                                          SSDEEP:768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
                                                                          MD5:982EAE7A49263817D83F744FFCD00C0E
                                                                          SHA1:81723DFEA5576A0916ABEFF639DEBE04CE1D2C83
                                                                          SHA-256:331BCF0F9F635BD57C3384F2237260D074708B0975C700CFCBDB285F5F59AB1F
                                                                          SHA-512:31370D8390C4608E7A727EED9EE7F4C568ECB913AE50184B6F105DA9C030F3B9F4B5F17968D8975B2F60DF1B0C5E278512E74267C935FE4EC28F689AC6A97129
                                                                          Malicious:false
                                                                          Preview:# init.tcl --..#..# Default system startup file for Tcl-based applications. Defines..# "unknown" procedure and auto-load facilities...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2004 Kevin B. Kenny. All rights reserved...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# This test intentionally written in pre-7.5 Tcl..if {[info commands package] == ""} {.. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]"..}..package require -exact Tcl 8.6.12....# Compute the auto path to use in this interpreter...# The values on the path come from several locations:..#..# The environment variable TCLLIBPATH..#..# tcl_library, which is the directory containing this init.tcl script...# [t

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\af.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1038
                                                                          Entropy (8bit):4.10054496357204
                                                                          Encrypted:false
                                                                          SSDEEP:12:4EnLB383Hcm0hH9BncmtR7tK9dUVxMmALfpKIdzVJLd3xfjTuLM+vzkHWZ6tH9H0:4aR838HH9ekCkMmEfpK2xx2jiWZ0VbY
                                                                          MD5:DA8BA1C3041998F5644382A329C3C867
                                                                          SHA1:CA0BD787A51AD9EDC02EDD679EEEEB3A2932E189
                                                                          SHA-256:A1EACA556BC0CFBD219376287C72D9DBBFAB76ECF9BF204FD02D40D341BAF7DA
                                                                          SHA-512:4F086396405FDFE7FBDA7614D143DE9DB41F75BDBD3DB18B1EE9517C3DCCED238DD240B4B64829FD04E50F602DBF371D42A321D04C4C48E4B8B2A067CA1BAF2E
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Ma"\.. "Di"\.. "Wo"\.. "Do"\.. "Vr"\.. "Sa"].. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \.. "Sondag"\.. "Maandag"\.. "Dinsdag"\.. "Woensdag"\.. "Donderdag"\.. "Vrydag"\.. "Saterdag"].. ::msgcat::mcset af MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset af MONTHS_FULL [list \.. "Januarie"\.. "Februarie"\.. "Maart"\.. "April"\.. "Mei"\.. "Junie"\.. "Julie"\.. "Augustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""].. ::msgcat::mcset af AM "VM

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\af_za.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.925537696653838
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xouFygMouFqF3v6ay/5ouFy9+3vR6HyFvn:4EnLB383RAgeYF3v6ay/RAI3voSVn
                                                                          MD5:1B9DCD1C6FCDDC95AE820EA8DA5E15B8
                                                                          SHA1:E8160353FD415BAB9FD5ACCA14E087C5E6AE836E
                                                                          SHA-256:1548988458BBF0DFCCC23B7487CEC0E9C64E4CC8E045723E50BEC37C454A8C81
                                                                          SHA-512:532AF060B95AED5E381B161BE56BC88D91A8F3DF2ACFD835491991F99FE752ADB4A3F93AB6D4E68F7042C28A3C1DD87A6312DFD9FFFAFD6ECE3F1B76837C5B7F
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y".. ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ar.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2018
                                                                          Entropy (8bit):4.477377447232708
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83gr/fsS/Sm8p4M/n1KsPktE30AiJcAxi9CEzdEvSCHvMSV:43UkiSm8p3nX0EzdCSCPV
                                                                          MD5:D264D01B46D96455715114CAEDF9F05E
                                                                          SHA1:A3F68A4C6E69433BD53E52B73041575F3B3AC3F2
                                                                          SHA-256:B69D0061A728D59F89FF8621312789CD9F540BF2E2ED297804D22F6278561D85
                                                                          SHA-512:A4163DAA6821B293EADD5D499E0641A8B7C93180C710D6B364AE8681A8FF6F35EC948C8DDBE960A8466AF1ACABC15B0D465A08B084617E8005D708459F7E74D3
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \.. "\u062d"\.. "\u0646"\.. "\u062b"\.. "\u0631"\.. "\u062e"\.. "\u062c"\.. "\u0633"].. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar MONTHS_ABBREV [list \.. "\u064a\u0646\u0627"\.. "\u0641\u0628\u0631"\.. "\u0645\u0627\u0631"\.. "\u0623\u0628\u0631"\.. "\u0645\u0627\u064a"\.. "\u064a\u0648\u0646"\.. "\u064a\u0648\u0644"\.. "\u0623\u063a\u0633"\.. "\u0633\u0628\u062a"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ar_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):265
                                                                          Entropy (8bit):4.872222510420193
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoKNvfcoKU3v6xyFjoKNo+3vfXM68vn:4EnLB3831vfD3v6g9F3vfc6+n
                                                                          MD5:430498B4AB1E77C86BC1311A49747581
                                                                          SHA1:684EAD965D9010C2A6E73DCACB2224FDE585F9FF
                                                                          SHA-256:2E04B96DA002519D28125918A22FF2BB9659A668A7BCAD34D85DDDECEC8DC0B4
                                                                          SHA-512:9F85A88A383DCFC54DAA6253D94C307A14B1CC91D5C97AF817B8122AF98025AB2430D0B2D656EBED09E78FB854D1F9CF99F3B791A6ECB7834112012739140126
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y".. ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ar_jo.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1851
                                                                          Entropy (8bit):4.08645484776227
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83sxS/Sm819+es/Ii/R91bpH0+U0c+es/Ii/R91bpH0+UO:43wiSm815MbJbHgMbJbp
                                                                          MD5:5C62D606F4F14BC8994B28F9622D70DD
                                                                          SHA1:E99F8CC5D330085545B05B69213E9D011D436990
                                                                          SHA-256:5ADBB3D37C3369E5FC80D6A462C82598D5A22FAEF0E8DF6B3148231D2C6A7F73
                                                                          SHA-512:81AC9200459B0896E27A028BD089A174F7F921B0367BC8FF1AB33D3E561417B6F8EC23DAB750ECB408AC8A11CDFDBFA4F890F9E723BB8607B017C9FEE00928A0
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ar_lb.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1851
                                                                          Entropy (8bit):4.083347689510237
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83LxS/Sm8S9+es/Ii/R91bpH0+U/c+es/Ii/R91bpH0+UO:431iSm8S5MbJbQgMbJbp
                                                                          MD5:6FC1CC738207E2F8E0871103841BC0D4
                                                                          SHA1:D2C62C7F6DA1EF399FCBE2BA91C9562C87E6152F
                                                                          SHA-256:1FC13070CF661488E90FECE84274C46B1F4CC7E1565EAB8F829CCAA65108DFCA
                                                                          SHA-512:E547D5CBB746654051AFDA21942075BC2224C2FF75D440C6C34C642AD24CF622E520FF919B8BD4AFC0116D9CE69B3ABA4E81EE247C1388F3C5741150201F5C60
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ar_sy.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1851
                                                                          Entropy (8bit):4.084701680556524
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83lxS/Sm8M9+es/Ii/R91bpH0+UBc+es/Iv/I91bpH0+UO:43LiSm8M5MbJbSgMo0bp
                                                                          MD5:8188C37CA44FEFFF8D895AAD503AD4F6
                                                                          SHA1:C48F2E3B9FC055704D2DAFDC67E9D08EE6897D45
                                                                          SHA-256:294F3E46C55453EDAD44567E1330F9B43E69A07FA0655B24DD2780A4490C1194
                                                                          SHA-512:F86FCFC7C460473D46C472041AB2E1F9388CF34BCA9050295D1DAE454E35A2A0320D0C61D5E8CBB832AF74FFDD1A7511AF32EA2A53B481F39A1CBCF5F086D514
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\be.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2157
                                                                          Entropy (8bit):4.27810535662921
                                                                          Encrypted:false
                                                                          SSDEEP:48:43PI8IKQGQ8mA/XxQJxQnA9QJlPyI/tbCaQICMIcQ8InVI5tNIzQFIQQLtChjsI4:2PItK5BSb9ajfycCW5IzdQNxK
                                                                          MD5:6334BDDFC1E0EAE4DBB2C90F85818FD8
                                                                          SHA1:085EDC3D027D6B5A6A6A2561717EA89C8F8B8B39
                                                                          SHA-256:A636A82C7D00CCDC0AF2496043FFA320F17B0D48A1232708810D3BB1453E881E
                                                                          SHA-512:18ADB77314FCFD534E55B234B3A53A0BC572AB60B80D099D2F3B20E0C5FE66179FDC076AA43200DB3CA123BC6216989EC41448FA624D3BA9633413AD8AD6034C
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0430\u0442"\.. "\u0441\u0440"\.. "\u0447\u0446"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \.. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\.. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\.. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\.. "\u0441\u0435\u0440\u0430\u0434\u0430"\.. "\u0447\u0430\u0446\u0432\u0435\u0440"\.. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset be MONTHS_ABBREV [list \.. "\u0441\u0442\u0434"\.. "\u043b\u044e\u0442"\.. "\u0441\u043a\u0432"\.. "\u043a\u0440\u0441"\.. "\u043c\u0430\u0439"\.. "\u0447\u0440\u0432"\.. "\u043b\u043f\u043d"

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\bg.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1871
                                                                          Entropy (8bit):4.4251657008559935
                                                                          Encrypted:false
                                                                          SSDEEP:48:43EUAIlnQf/QVdQ81mnEZqEavWQEQ3QvQrQL0QjQTtQDCQSY4tqP:27xMk+nEZqE3biIYbUi+C9y
                                                                          MD5:E5225D6478C60E2502D18698BB917677
                                                                          SHA1:52D611CB5351FB873D2535246B3A3C1A37094023
                                                                          SHA-256:CFE4E44A3A751F113847667EC9EA741E762BBDE0D4284822CB337DF0F92C1ACA
                                                                          SHA-512:59AB167177101088057BF4EE0F70262987A2177ECB72C613CCAAE2F3E8D8B77F07D15DA5BE3B8728E23C31A1C9736030AA4036A8CD00A24791751A298B3A88B3
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0434"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u043b\u044f"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0421\u0440\u044f\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\.. "\u041f\u0435\u0442\u044a\u043a"\.. "\u0421\u044a\u0431\u043e\u0442\u0430"].. ::msgcat::mcset bg MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset bg MO

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\bn.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2335
                                                                          Entropy (8bit):4.107102006297273
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR835e/MWrD//6HFEVcVVcCVcTUTVckVEVcT7VcEEVcby/Vcn0VcMr/0VcM8VcQ:43ktX++QalMObalMZ6IE6V
                                                                          MD5:5D25E7FC65824AC987535FEA14A4045C
                                                                          SHA1:85C10F05823CD3263FC7B3EC38796BEC261B3716
                                                                          SHA-256:890EA6521DEB1B3C3913CCD92562F6360E064DAEE2E2B0356A6DD97A46264A1F
                                                                          SHA-512:5D8A88ACAEBBF3CD721F288FA0F1FEE517EE568CA5482E30CFA1E36CD37DF011C449090E2D9041F1D046A191F13D4C5C4B6F9E2F16FD259E63CE46ECC4E4F81F
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \.. "\u09b0\u09ac\u09bf"\.. "\u09b8\u09cb\u09ae"\.. "\u09ae\u0999\u0997\u09b2"\.. "\u09ac\u09c1\u09a7"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\.. "\u09b6\u09c1\u0995\u09cd\u09b0"\.. "\u09b6\u09a8\u09bf"].. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \.. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\.. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\.. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\.. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\.. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\.. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"].. ::msgcat::mcset bn MONTHS_ABBREV [list \.. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\.. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\bn_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):265
                                                                          Entropy (8bit):4.868201122972066
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xovtvfluo/E3v6xyFjovto+3vflm68vn:4EnLB383UtvfltE3v6g8tF3vflm6+n
                                                                          MD5:B91BB2ABC23B90962D2070B9588F2AB5
                                                                          SHA1:CBB4E9CD600773792C6E9F3E6B27E99C1846B44F
                                                                          SHA-256:B3D8A4632290B0F3DA690E47C1FDF06A8B9E171A96E938AFDB0DD52CF806CE54
                                                                          SHA-512:932FC4B8C3CA72731187D56012AD7DD7777C4D447F16EEB17B9D68235C9590DF99992FD22B8D7C85A843A610F93CD36FAFA993C34C441255A1C0A93C73BC5FE4
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ca.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1152
                                                                          Entropy (8bit):4.2880653012847985
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83FMVBNfPg+g+RjMu5+C6MB4zdiwvWvn:432g6jh65zd3gn
                                                                          MD5:72DDD60C907DD235BCE4AB0A5AEE902C
                                                                          SHA1:06150F793251687E6FBC3FDA3BC81BCBFC7DE763
                                                                          SHA-256:3BE295DCC8FCDC767FED0C68E3867359C18E7E57D7DB6C07236B5BC572AD328E
                                                                          SHA-512:3B0A85003692F1E46185D5CC09236D2DA5E6D29166C9812D07A7D6BF6AC6C3B0708F91C6899768D4DBA3528081B8B43E09F49622B70F1CF991AFAC5352B6BA37
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \.. "dg."\.. "dl."\.. "dt."\.. "dc."\.. "dj."\.. "dv."\.. "ds."].. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \.. "diumenge"\.. "dilluns"\.. "dimarts"\.. "dimecres"\.. "dijous"\.. "divendres"\.. "dissabte"].. ::msgcat::mcset ca MONTHS_ABBREV [list \.. "gen."\.. "feb."\.. "mar\u00e7"\.. "abr."\.. "maig"\.. "juny"\.. "jul."\.. "ag."\.. "set."\.. "oct."\.. "nov."\.. "des."\.. ""].. ::msgcat::mcset ca MONTHS_FULL [list \.. "gener"\.. "febrer"\.. "mar\u00e7"\.. "abril"\.. "maig"\.. "juny"\.. "juliol"\.. "agost"\.. "setembre"\.. "octubre"\.. "novembre"\.. "desembre"\.. ""].. ::msg

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\cs.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1354
                                                                          Entropy (8bit):4.466447248030554
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83U4nZ4yJTkkG3mYWEZqO1R3DNBEVG+PYhxrU4UF3ecCvt7/v3e6:43TJTGmnEZqE5/EVEDOGtDp
                                                                          MD5:F32EAD82CC26754C5A8E092873A28DB3
                                                                          SHA1:325124660F62242B24623B4B737CB4616F86CFF3
                                                                          SHA-256:AFEA12A16A6FA750EA610245133B90F178BA714848F89AEC37429A3E7B06BE1A
                                                                          SHA-512:04E335AAFBF4D169983635FC87BCFFE86FBA570A3E1820D20240EF7B47E7A3CD94AE3598543DCE92A1F82B5146CAAD982EFE9490EFD9E581D58515CFC3930581
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "\u00dat"\.. "St"\.. "\u010ct"\.. "P\u00e1"\.. "So"].. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \.. "Ned\u011ble"\.. "Pond\u011bl\u00ed"\.. "\u00dater\u00fd"\.. "St\u0159eda"\.. "\u010ctvrtek"\.. "P\u00e1tek"\.. "Sobota"].. ::msgcat::mcset cs MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset cs MONTHS_FULL [list \.. "leden"\.. "\u00fanor"\.. "b\u0159ezen"\.. "duben"\.. "kv\u011bten"\.. "\u010derven"\.. "\u010dervenec"\.. "srpen"\.. "z\u00e1\u0159\u00ed"\.. "\u0159\u00edjen"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\da.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1208
                                                                          Entropy (8bit):4.315504392809956
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83wV0tBVYuorIsmZ5meAxyISjTHU92WFVwpwvbvT:43w+DiuorreAY0zw8rT
                                                                          MD5:27A6A8BE8903AEF9D0BE956906A89583
                                                                          SHA1:EE29FDF67CB3AE150DF6BBBE603C1C3F5DA28641
                                                                          SHA-256:0D422A991BCA13FE9033118691CFEDAB0F372222EBB0BC92BAF8E914EE816B84
                                                                          SHA-512:0E702A679AD94BF479226B7DE32077562F3F95210F6453AE564138386DBB179941BA5359AEE9AC532F4A6E5BE745D6962D6B638A21DD48B865716F2FD2A0CB01
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset da MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset da MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marts"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset da B

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\de.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1276
                                                                          Entropy (8bit):4.349293509679722
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83cFNSsZKKgXum47fpK2OaSIui7dHqWZ0ZIBFJWJvvvWIn:43InZKKgXoOqx1W67W9XWIn
                                                                          MD5:EE3963A5F7E29C05C9617BE3FD897114
                                                                          SHA1:0F978CA174DF596817F872B5EF1B447B9DFE651C
                                                                          SHA-256:4C27733502066E8391654D1D372F92BF0484C5A3821E121AE8AA5B99378C99AE
                                                                          SHA-512:EA933709C68F8199858A1CC1FFDA67EE7458CC57A163E672535EB0B4C37BFDC200604C7506748DAC3158B6CA63C2F076A2C6252B2A596E59F83D3B1D4BC9C901
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Mo"\.. "Di"\.. "Mi"\.. "Do"\.. "Fr"\.. "Sa"].. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mrz"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de BCE "v.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\de_at.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):847
                                                                          Entropy (8bit):4.412930056658995
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR831sMm47fpK2++SIui7dHqWZ0ZItovGvzvW:431h+mx1Wm+QjW
                                                                          MD5:A6227CD4F7434952D093F1F3C64B4378
                                                                          SHA1:0DDB9A49CB83DDF2396B2ECA85093260710496C2
                                                                          SHA-256:1C02D14140196623297F858E2EEF00B4159E1C6FAFE044EC65A48C9C24D46540
                                                                          SHA-512:D63F34024356F5CE0335D14EA557F4BBF238CCA8265DD27C039C70F7F28FE737F368B030DEE10B2C536512D2815E1F5B19838D08745C6A76A39050D573597EB3
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_AT MONTHS_ABBREV [list \.. "J\u00e4n"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_AT MONTHS_FULL [list \.. "J\u00e4nner"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset de_AT TIME_FORMAT "%T".. ::msgcat::mcset de_AT TIME_FORMAT_12 "%T".. ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\de_be.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1276
                                                                          Entropy (8bit):4.389082225723362
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83B8VSysVB8VsZKKgJ5Mm47fpK26aSIui7dHqWZ0ZIlj5VevjevbDvW:43Bt1VBbZKKgJs6qx1Wc5VojobzW
                                                                          MD5:C351057D8E5328C0790901D1F4DBEC9F
                                                                          SHA1:F73DE8AEF7F8083B0726760AA003E81067A68588
                                                                          SHA-256:532845CD15EC821C1939D000C648694A64E8CA8F0C14BAD5D79682CF991481CE
                                                                          SHA-512:8152AD082D0A6A4EBE7E1CCA9D4A5F2E48ABE3F09F4385A517C523A67CA3B08E0F20C193D0F6850F37E55ED0CD6FBD201FE22CC824AF170976D04DB061212F2D
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \.. "Son"\.. "Mon"\.. "Die"\.. "Mit"\.. "Don"\.. "Fre"\.. "Sam"].. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de_BE MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_BE MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::m

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\el.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2304
                                                                          Entropy (8bit):4.371322909589862
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR833v+ZYYWtv+nWfFyL1NYOg+EKVJQ19tWQYmYaYRn9sWuSAJIJ6eRa6WrmdlX:43/pZyLjY0uYR9QmdkjC9r
                                                                          MD5:7DD14B1F4FF532DCAF6D4C6F0DF82E9A
                                                                          SHA1:707875FEF4207EBB71D066FDC54C7F68560C6DAD
                                                                          SHA-256:8B23E0E2F0F319BB9A2DFDCCDC565FF79A62FA85094811189B6BC41594232B6B
                                                                          SHA-512:5ECA072DE5DD7890270AE268C7C8D40EE2DB6966643604D16E54194DB0AD74FDA8D04848331E61B387E8B494AF18252E38671D939069EC4C90C672A629563B88
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \.. "\u039a\u03c5\u03c1"\.. "\u0394\u03b5\u03c5"\.. "\u03a4\u03c1\u03b9"\.. "\u03a4\u03b5\u03c4"\.. "\u03a0\u03b5\u03bc"\.. "\u03a0\u03b1\u03c1"\.. "\u03a3\u03b1\u03b2"].. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \.. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\.. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\.. "\u03a4\u03c1\u03af\u03c4\u03b7"\.. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\.. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\.. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\.. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"].. ::msgcat::mcset el MONTHS_ABBREV [list \.. "\u0399\u03b1\u03bd"\.. "\u03a6\u03b5\u03b2"\.. "\u039c\u03b1\u03c1"\.. "\u0391\u03c0\u03c1"\.. "\u039c\u03b1\u03ca"\.. "\u0399\u03bf\u

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_au.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):307
                                                                          Entropy (8bit):4.896073290907262
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoCwmGjbmvFjoCws6W3v1oCws6W3v6p6HyFjoCwmT+3vjbe:4EnLB383QrmdSs6W3vss6W3v6QSoJ3ve
                                                                          MD5:5B31AD8AC0000B01C4BD04BF6FC4784C
                                                                          SHA1:F55145B473DDCAE38A0F7297D58B80B12B2A5271
                                                                          SHA-256:705C66C14B6DE682EC7408EABDBA0800C626629E64458971BC8A4CBD3D5DB111
                                                                          SHA-512:1CCE6BCAE5D1F7D80E10687F0BCA2AE1B2DD53F04A0F443DC9B552804D60E708E64326B62BA4E3787325D89837B4AC8CCCA9AF6F39CBD654BCC8A9C27EA63BB8
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_be.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):312
                                                                          Entropy (8bit):4.870560620756039
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoCr3FuoCsX3vtfNrsoCsX3v6YNIdjoCs+3v3FnN9vn:4EnLB383H3Fb3vtNN3v6y43v3FnNNn
                                                                          MD5:DDA87ACED97F9F7771788A1A0A1E4433
                                                                          SHA1:E221653CD659C095098180344654770FF059331B
                                                                          SHA-256:BC87754A253C1036E423FA553DA182DBC56F62A13EDA811D8CD9E8AFA40404A6
                                                                          SHA-512:BB95D9241B05686CA15C413746DD06071635CB070F38847BE9702397A86C01A3D54DEBE1ACAA51834AB74DB8D0F75E353995183864E382721425756EE46B0B1E
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z".. ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_bw.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.915769170926952
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xosmGMoss6W3v6ay/5osmT+3vR6HyFvn:4EnLB383hr8s6W3v6ay/hJ3voSVn
                                                                          MD5:4CBF90CE15ECCB6B695AA78D7D659454
                                                                          SHA1:30C26ADB03978C5E7288B964A14B692813D6E0B8
                                                                          SHA-256:EC48F18995D46F82B1CC71EA285174505A50E3BA2017BCCE2D807149B7543FD0
                                                                          SHA-512:CC809EBD1B2B5D9E918C2E2CE4E7075DFB0744C583F17C1C234D8437EF0C34654D2F09FF77544AD3430CEC78ABC70AA5F85F71AD1489A687B8087FCDFE07B088
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_ca.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):295
                                                                          Entropy (8bit):4.87629705076992
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoAhgqyFjoAZF3vX5oAZF3v6cvBoAh9+3vnFDL8vn:4EnLB383FhgqWDZF3vVZF3v6cvdhI3vM
                                                                          MD5:BFC4A48F5B10D137A4D32B440C47D3C6
                                                                          SHA1:C90EF2A8291DE589BC12D0A5B8AF2F0B00FEB7CD
                                                                          SHA-256:3CF2D0937FD95264549CF5C768B898F01D4875A3EB4A85D457D758BC11DFEC6E
                                                                          SHA-512:A91B81A956A438CA7274491CA107A2647CBDFB8AEB5FD7A58238F315590C74F83F2EBA4AA5C4E9A4A54F1FC1636318E94E5E4BBEA467326E0EACED079741E640
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_CA TIME_FORMAT "%r".. ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p".. ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_gb.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.892405843607203
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoEbtvqyFjoELE3vLjoELE3v6mjoEbto+3vnFDoAkvn:4EnLB383BbtvqWHLE3vTLE3v6EbtF3vW
                                                                          MD5:52E55DE8C489265064A01CEEC823DCDD
                                                                          SHA1:16F314A56AE0EAC9DAD58ADDEA6B25813A5BAA05
                                                                          SHA-256:C2CE5B74F9E9C190B21C5DF4106303B7B794481228FB9A57065B9C822A1059C3
                                                                          SHA-512:6010F29BF75D0CB4EE4F10781423A8CC68D5018DE8C633CD1217A7FE1299A0532E8C0E5D120188B748171EB255C587BB0B64B7384A58F725F3B6A4B9EA04393E
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_GB TIME_FORMAT "%T".. ::msgcat::mcset en_GB TIME_FORMAT_12 "%T".. ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_hk.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):329
                                                                          Entropy (8bit):4.851471679101967
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoa+joaQ9PoaAx/G4soaYYW3v6ay/5oaAx/T+3v4x6HyFvn:4EnLB383BSiF4KxW3v6ay/B/3v4ISVn
                                                                          MD5:DE2A484508615D7C1377522AFF03E16C
                                                                          SHA1:C27C0D10E7667AD95FFF731B4E45B2C6E665CC36
                                                                          SHA-256:563450A38DB6C6A1911BC04F4F55B816910B3E768B1465A69F9B3BD27292DBEE
                                                                          SHA-512:A360B0FD7E36BCC0FB4603D622C36199E5D4C705396C6701F29730EB5CB33D81B208541CADFAED5303FC329C7C6A465D23CA9584F0DEC2DE128E258478DD6661
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_HK AM "AM".. ::msgcat::mcset en_HK PM "PM".. ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_ie.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.833246107458447
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoK6qyFjoKi+3vLjoKi+3v6mjoKv+3vnFDoAkvn:4EnLB383CqW13vJ3v6b3v9dmn
                                                                          MD5:57F0BBE1316D14BC41D0858902A7980A
                                                                          SHA1:B68BF99A021B9F01FE69341DF06F5D1453156A97
                                                                          SHA-256:9E0DCEE86A03B7BDD831E0008868A9B874C506315BF01DF3982AD3813FD3BA8E
                                                                          SHA-512:864F32254AAD39859AFC47D0C90DC5F38CA86EF0BBC7DE61BE253756C22B7806E616B59802C4F4D7B2F5543BF7C070FFF6FAF253E0A337EC443337E63A2E5A57
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_IE TIME_FORMAT "%T".. ::msgcat::mcset en_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):318
                                                                          Entropy (8bit):4.80637980762728
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoKr3ujoKrGtoKr5vMoKrw3v1oKr5o+3voAsvn:4EnLB383T9xvT3vJF3vonn
                                                                          MD5:1A54E506E70B2125C6016B373D3DD074
                                                                          SHA1:15289902BAA93208D8FB224E119166D0E044E34E
                                                                          SHA-256:ADEA3A1AB8AA84237DDB2F276ABDB96DCB4C51932E920D1A5E336904E1138664
                                                                          SHA-512:0D663233E6C96515713B3B829B605E72D8CE581AEF1C02FF6CA96598C040DCA42A3AC765EE9B5002E8969A331EB19A9AF0F8215F7113D0AD2F2EB2C560239D53
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IN AM "AM".. ::msgcat::mcset en_IN PM "PM".. ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_nz.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):307
                                                                          Entropy (8bit):4.939458132662909
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoyejbmvFjo63v1o63v6p6HyFjoy7+3vjb0ysvn:4EnLB383temdj3vd3v6QS1S3ven
                                                                          MD5:7E81708F107658FFD31C3BFBF704A488
                                                                          SHA1:7941ED040707591B68581337F8D90FA03C5E1406
                                                                          SHA-256:EC305B7CB393421E6826D8F4FEA749D3902EBA53BFA488F2B463412F4070B9ED
                                                                          SHA-512:8F038FF960F81D96FF9E3454D8ABDA7FFDA5B99DA304ACECC42E74DDBED839388246F66B58928DA902D3B475FBA46602B34F6829A87ECB1124FFC47C036B4DBE
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_ph.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):329
                                                                          Entropy (8bit):4.824360175945298
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoojoOo2e4soe3v6ay/5o27+3v4x6HyFvn:4EnLB38304u3v6ay/k3v4ISVn
                                                                          MD5:E2E3BD806C20D7FB88109B7F3B84C072
                                                                          SHA1:2D7AD6BECA9C4D611BAE9747AD55A3E9385C2B42
                                                                          SHA-256:3A9C22B07906544C04F7A29B800FCE87C09D7FDF5C251236925115CF251A3890
                                                                          SHA-512:B14756B59BCABF8B29B41AC688E4F3A011735AF190B88F88B7B5FDDD3DA77F63FFC0F7875B3B453729CD3BC65E79F75F6E632CA68952EF473F78337D89E80BF2
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_PH AM "AM".. ::msgcat::mcset en_PH PM "PM".. ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_sg.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.911413468674953
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoQW53FuoQGuX3v6ZwoQWa+3v3F0fxvn:4EnLB383V83FOJ3v62c3v3FEn
                                                                          MD5:F70245D73BE985091459ADF74B089EBC
                                                                          SHA1:21D52C336C08526D9DCF1AEC1F0701CB8B073D7A
                                                                          SHA-256:D565679AE9AACBFE3B5273FE29BD46F46FFBB63C837D7925C11356D267F5FF82
                                                                          SHA-512:171C70EB10D5E6421A55CE9B1AE99763E23FB6A6F563F69FE099D07C07FCA0CF8D3F6F00C5BB38BFF59A5F4C311506C4A9593F86C12B3B9E1861E72656B3800B
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_za.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):251
                                                                          Entropy (8bit):4.937431055623088
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoOr0lIZoOK3v6poOs+3v0l6Uvn:4EnLB383z+3v6R3vl2n
                                                                          MD5:FCA7B13CA6C9527D396A95BEA94CC92D
                                                                          SHA1:E6F338A08F72DA11B97F70518D1565E6EF9AD798
                                                                          SHA-256:67C253E2A187AA814809418E5B7A21F3A1F9FB5073458A59D80290F58C6C1EB4
                                                                          SHA-512:37B8B4EA24B1C77AF0252A17660650CB2D4F8BB55C75817D6A94E1B81A3DDEF9913D12D3BF80C7BFE524CD0AD84E353E73238056759E6545BFE69EF5F806B8B7
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d".. ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S".. ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\en_zw.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.934659260313229
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoEmGMoEs6W3v6ay/5oEmT+3vR6HyFvn:4EnLB383Zr0s6W3v6ay/ZJ3voSVn
                                                                          MD5:A302091F490344B7A79C9463480AD7CF
                                                                          SHA1:E3992D665077177BAD5A4771F1BAF52C2AD1829C
                                                                          SHA-256:6F4754CE29DFA4F0E7957923249151CE8277395D1AF9F102D61B185F85899E4E
                                                                          SHA-512:FEBDB0BD6D0FD4C592DB781836F93F0C579399D324112F8829B769303CC6EEA487AAB14EBD60ED1B4F3B3DABF501601C9F65656327FF54853BF2CD9EC6A2F00F
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\eo.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1285
                                                                          Entropy (8bit):4.3537859241297845
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83dRb4vyomrIsmZ55vrAO0LH+50ydAcveva:43PT5rWvrAR60yW6oa
                                                                          MD5:D87605E6282713EED41D56D53B7A04FD
                                                                          SHA1:41AAD4BD3B72CCBB6A762FEED3C24931642DD867
                                                                          SHA-256:98D52CAB5CA65789D1DC37949B65BAF0272AB87BCCBB4D4982C3AF380D5406AB
                                                                          SHA-512:4A4F51B2FD0248B52530B5D9FE6BFCFE455147CBE2C1F073804A53666945405F89CBBAD219FFF6904C1F92885F7C53B9D9A969732D662CEA8EC1717B3303B294
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \.. "di"\.. "lu"\.. "ma"\.. "me"\.. "\u0135a"\.. "ve"\.. "sa"].. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \.. "diman\u0109o"\.. "lundo"\.. "mardo"\.. "merkredo"\.. "\u0135a\u016ddo"\.. "vendredo"\.. "sabato"].. ::msgcat::mcset eo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "a\u016dg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset eo MONTHS_FULL [list \.. "januaro"\.. "februaro"\.. "marto"\.. "aprilo"\.. "majo"\.. "junio"\.. "julio"\.. "a\u016dgusto"\.. "septembro"\.. "oktobro"\.. "novembro"\.. "decembro"\.. ""].. ::m

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1232
                                                                          Entropy (8bit):4.2910064237800025
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83hEVIhlp4herIsYoorrClH+Fo9ARhprBvtFvr6:43OVY7+ercrmsYsr1thr6
                                                                          MD5:91DE6EE8E1A251EF73CC74BFB0216CAC
                                                                          SHA1:1FB01E3CF2CAFA95CC451BC34AB89DC542BBD7DD
                                                                          SHA-256:E9A6FE8CCE7C808487DA505176984D02F7D644425934CEDB10B521FE1E796202
                                                                          SHA-512:46CFD80E68461F165EE6A93AB6B433E4D4DA6A9A76CB7F3EF5766AC67567A7AFFB7B4E950A5AFA7C69C91F72AC82D2A448D32E39BBFC0BF26D2257460471EEC1
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mi\u00e9"\.. "jue"\.. "vie"\.. "s\u00e1b"].. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \.. "domingo"\.. "lunes"\.. "martes"\.. "mi\u00e9rcoles"\.. "jueves"\.. "viernes"\.. "s\u00e1bado"].. ::msgcat::mcset es MONTHS_ABBREV [list \.. "ene"\.. "feb"\.. "mar"\.. "abr"\.. "may"\.. "jun"\.. "jul"\.. "ago"\.. "sep"\.. "oct"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset es MONTHS_FULL [list \.. "enero"\.. "febrero"\.. "marzo"\.. "abril"\.. "mayo"\.. "junio"\.. "julio"\.. "agosto"\.. "septiembre"\.. "octubre"\.. "noviembre"\.. "diciembre"\.. ""].. ::msgc

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_ar.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):248
                                                                          Entropy (8bit):4.878377455979812
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo8GzvFjot/W3v1o8T+3v9ysvn:4EnLB3833GzdV3vLK3vnn
                                                                          MD5:313966A7E4F50BB77996FDE45E342CA9
                                                                          SHA1:021DF7211DAE9A635D52F7005672C157DBBAE182
                                                                          SHA-256:B97DCEA4FEC3E14632B1511D8C4F9E5A157D97B4EBBC7C6EE100C3558CB2947F
                                                                          SHA-512:79DCC76263310523BAF1100C70918FCE6BECB47BE360E4A26F11C61F27E14FC28B588A9253AA0C1F08F45AE8A03312A30FBDCF4FDFFDC5BF9D086C4B539DE022
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_bo.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.924579610789789
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoYePWWjoU3v6ry/5oY7+3vPUe6HyFvn:4EnLB383nedh3v6ry/nS3vs3SVn
                                                                          MD5:EF58B1097A3C6F2133BD7AA8CCC1AD1B
                                                                          SHA1:BD479E4635F3CD70A6A90E07B7E92757BC9E2687
                                                                          SHA-256:B47F55539DB6F64304DEA080D6F9A39165F1B9D4704DCBA4C182DBD3AA31A11B
                                                                          SHA-512:F9EB1489E5002200D255A45DC57132DEFD2A2C6DE5BC049D0D9720575E4FDD1B6A212D9E15974C6A2E0D0886069EA0DD967AD7C20845EC38EB74CBED0C3E5BE1
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_cl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.9352990174129925
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xodvPWWjok3v6ry/5odo+3vPUe6HyFvn:4EnLB383OdV3v6ry/i3vs3SVn
                                                                          MD5:42BCE0EE3A3F9E9782E5DE72C989903A
                                                                          SHA1:0960646417A61E8C31D408AE00B36A1284D0300E
                                                                          SHA-256:9D1A2A6EBA673C6F6D964DBCDDF228CB64978F282E70E494B60D74E16A1DB9CB
                                                                          SHA-512:C53DDCC17F261CFFAA2205879A131CFD23A7BCF4D3787090A0EA8D18530C4805903ED6CF31B53A34C70510A314EBBB68676E9F128289B42C5EFBC701405D5645
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_co.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.908553844782894
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo4FjbmvFjo4F+3v6ry/5o4++3vjb0f6HyFvn:4EnLB3831mdD+3v6ry/P3vbSVn
                                                                          MD5:6A8F31AE734DCEE4845454408CDB3BC5
                                                                          SHA1:A3B9A0124D3CFA9E0E5957612897B23193AD5D59
                                                                          SHA-256:5FAC53ACFB305C055AFD0BA824742A78CB506046B26DAC21C73F0BB60C2B889A
                                                                          SHA-512:188A65CFE2FBD04D83F363AEA166F224137C8A7009A9EBEB24B2A9AC89D9484D3A7109A4CE08F5C0A28911D81571230CC37554F4F19956AE163F9304911EE53C
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_cr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.919346233482604
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo76GzvFjoTW3v6ry/5o76T+3v9f6HyFvn:4EnLB383K6Gzdj3v6ry/K6K3vMSVn
                                                                          MD5:2EDDA3F61BA4D049E6C871D88322CF72
                                                                          SHA1:40AFB64AF810596FCBDBD742ACAFE25CE56F3949
                                                                          SHA-256:A33DC22330D087B8567670B4915C334FF1741EE03F05D616CC801ECFDA1D9E64
                                                                          SHA-512:B6A6059B44F064C5CB59A3DAFAA7BE9064EE3E38F5FA6391017D931EF3A2B471DC4D556B7BEC6852FD1F6260EF17F476754D6BEA89E035748E9304977513CFB5
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_do.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.913083040975068
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xomerQZ2jou3v6ry/5om7+3vrQZg6HyFvn:4EnLB383sk4/3v6ry/s3vkrSVn
                                                                          MD5:76CFD4F568EA799F9A4082865633FF97
                                                                          SHA1:B09846BBF7A78243A5075F2DC9241791DCBA434B
                                                                          SHA-256:8DC2F857E91912ED46A94EB6B37DD6170EA7BCDDCD41CB85C0926A74EE12FCC1
                                                                          SHA-512:58B20A8A5D1F8C19AC36E61965106266B7E6F7E95DDD6AD9C4BB9FD7FFC561CB0E2103639D901A6A78CE2DD154CBF7F3AE0F71B4DC1CCB11DC6BB40D9C6E2157
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_ec.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.915857529388286
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xozgzvFjoro+3v6ry/5oz9+3v9f6HyFvn:4EnLB383OgzdkF3v6ry/OI3vMSVn
                                                                          MD5:94B713B1560FE7711EA746F1CEBD37CD
                                                                          SHA1:E7047E8F04D731D38FA328FBC0E1856C4A8BB23D
                                                                          SHA-256:52AB5A6C9DD4F130A75C049B3AF8F54B84071FC190374BCCF5FA0E1F3B91EB21
                                                                          SHA-512:EE807D4D74A609F642CC3C6FC3D736708F67A6931DEB95288AB5822DA256BE4C908A346036195CF4266408458906D28BB5C715EEAFCACFC4FE45D4E6D8E435FE
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_gt.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.9102355704853435
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xohvjbmvFjoI3v6ry/5oho+3vjb0f6HyFvn:4EnLB383KmdJ3v6ry/W3vbSVn
                                                                          MD5:761D0A468DF2EE75BC2CAB09D5FF38CD
                                                                          SHA1:D627BE45FE71CCB3CA53153393C075FF5136C2F3
                                                                          SHA-256:19B4D3025156C060A16328370A3FDB9F141298DECFC8F97BE606F6438FECE2EE
                                                                          SHA-512:6CF7C9004A8A3B70495862B7D21921B1A6263C2153FEBC5C4997366498ABBFE70263B436C2B4998550780A4C3A58DCF0AAE7420FF9D414323D731FA44BD83104
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_hn.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.947925914291734
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoIvriSFjoP3v6ry/5oIo+3vrig6HyFvn:4EnLB383V+2m3v6ry/v3v+lSVn
                                                                          MD5:33CEE7F947A484B076F5FA7871A30FEB
                                                                          SHA1:F77F8D1F42008770A6FF1F5097C863ECF482BEBE
                                                                          SHA-256:07873D4D59BB41000706A844859C73D26B1FF794058AA83CFFCA804981A24038
                                                                          SHA-512:EBF6873F9CB554489EFCD352943100C00171E49D27153769D1C4DB25E2D1F44F2D34869B596C267C9BB59ED0444468D9982137CFB1C6035FB15A855BB867133B
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_mx.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.9102355704853435
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoPjbmvFjoH+3v6ry/5oI+3vjb0f6HyFvn:4EnLB383UmdD3v6ry/k3vbSVn
                                                                          MD5:678D7A6DC32355246BF3AC485A24AF4D
                                                                          SHA1:B6C273D3BE5FB9F5A221B0333870CCE41CEDFDE4
                                                                          SHA-256:A0F57137D2C0ABDC933E03CFB188F5632176C195CEADB9DC80D469C8DC6CEDC6
                                                                          SHA-512:571404CCB0591C681C975E3F7A6C6972FAF2362F1D48BFC95E69A9EAE2DB3F40BF4B666C41950C4924E3FD820C61ED91204F92283B8554F1BD35B64D53BD4125
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_ni.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.918215906418583
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoe/GriSFjo3W3v6ry/5oe/T+3vrig6HyFvn:4EnLB383Re+2eW3v6ry/RS3v+lSVn
                                                                          MD5:471C41907CE5DB1F30C647A789870F78
                                                                          SHA1:C575A639609620AF7C56430991D0E4C2B50BDEC5
                                                                          SHA-256:6250663DA1378E54BEDCEF206583D212BC0D61D04D070495238D33715BB20CAE
                                                                          SHA-512:CAE32DF8F583542CAFE3292501725D85B697A5C1F9A0A7993490E8A69B6CE5CE3DE3AA2733B14D989A8D13B5E31B437DB42E9AB9D1851FE72313592C752B5061
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_pa.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.906719336603863
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoX5rQZ2joHE3v6ry/5oXa+3vrQZg6HyFvn:4EnLB383ak4F3v6ry/G3vkrSVn
                                                                          MD5:571F6716293442672521F70854A5AD05
                                                                          SHA1:525EBDEA6F85FC769B6C0C0B179BD98381647123
                                                                          SHA-256:EBB661C1C09E7D4F6FBCC4B2DAD0F41442B1FFDD27F003ABDC0375DD316E57D7
                                                                          SHA-512:C6176EE48515BDFC09B8347DAC5FD2C0165AA765916457DC7B057E526785AC912481CB72F118D2943372213B23CE3C39739263C2B3DA4DBFEB24C522ACC0439D
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_pe.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.90959433688075
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoIgzvFjoQ9X3v6ry/5oI9+3v9f6HyFvn:4EnLB383+zdB3v6ry/y3vMSVn
                                                                          MD5:5A5997D834DDD3E2E8FF8C6956AD54AC
                                                                          SHA1:AB4110E37B3665D738A8F2B3E64CBA9E99127301
                                                                          SHA-256:90C130B66958CF63CB3DDD2C633E58444357DBAB44C56831DD794CBD2EB1AED0
                                                                          SHA-512:1FEB8E77EA7B886E4A06279AC8A4B6200DBB86DCD28989651B92A0C9147A7BCFBB871DF8F904A1CF8F869BFFBD21325505AC44A4DBEBE1EFC87D43174597F1F3
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_pr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.905689521403511
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo06GriSFjoeW3v6ry/5o06T+3vrig6HyFvn:4EnLB383gG+263v6ry/gK3v+lSVn
                                                                          MD5:CE811BB8D12C7E6D53338759CCFB0A22
                                                                          SHA1:0AED290AA479DE6887CCB58D3F0A0F379EF8D558
                                                                          SHA-256:F790E8E48DC079DCD7DEB58170561006A31294F7E4ACBF9CF2ABFA3DB9E3FA9E
                                                                          SHA-512:0C73654CC3D33F76D9BF545BD6C5E42CBDD10B6D9750BFD6536806010F3B6A3C3647FB9D5E7E75A39823FDB857E13D07B7F987809C94B9F980E6D3A6D3108E85
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_py.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.917539255090736
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo/5zvFjovE3v6ry/5o/a+3v9f6HyFvn:4EnLB383Czdt3v6ry/+3vMSVn
                                                                          MD5:9CD6FAC4121E3D287C87157142E32845
                                                                          SHA1:3081FE2197017EC8E052756A407880C1C4ED026A
                                                                          SHA-256:70263F7EB22822DFEE8849B7AC4418ED9331275A71E77236B59226396505CDFF
                                                                          SHA-512:25DC054085C4078734988EEDD87E31ABE93DA8B43512E924DE4BCDE9F8EC670436B72FAD1855484F9AC71DD0BEDD9ED30304D02219C4FFC4B0516D8889BDF9F9
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_sv.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.929035824905457
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xofriSFjo3+3v6ry/5oY+3vrig6HyFvn:4EnLB383Y+22+3v6ry/Q3v+lSVn
                                                                          MD5:AF300EA6E733DC6820768EA16194B472
                                                                          SHA1:7766A6EB3D07BCC759CF6718EF3D6EC3FCE13565
                                                                          SHA-256:26A38B3745C95673D21BABB987F1D41EE08DDA945C670F5432BA0CE6F893C0E9
                                                                          SHA-512:C38D67C912584BE539D71881C6517AC186CBB336A160602DA716CE2708B2D38CE8FA7DD23EDB98890ABB7119B924B6C7816C18EC18F20C49D6284DF2386E32EE
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_uy.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.923802447598272
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xooygzvFjooq9X3v6ry/5ooy9+3v9f6HyFvn:4EnLB3835rzdbsX3v6ry/5J3vMSVn
                                                                          MD5:2DC550FEC3F477B1159B824479BCE707
                                                                          SHA1:4D0B20CF3E50B64D74655A405A7750E0B0BB4375
                                                                          SHA-256:1291B58810739EA0651493DD7887F5EE3E14BDB806E06DD4BB8AE2520C742EDA
                                                                          SHA-512:B12B927ACA6274904928A6A6CAEC8339A794C74A1F1804FF93AABC132AF9AD8AC5117F20067A60EFEBC9887150D7ACA5BE9643FF61509666011FD203211C25B9
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\es_ve.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.928484426267027
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoXrzvFjoXK3v6ry/5oXs+3v9f6HyFvn:4EnLB3838zdv3v6ry/c3vMSVn
                                                                          MD5:184D6C4B9F0AA874DEB959F63F7CC01B
                                                                          SHA1:5FB370B498289590C977F6B489FF646F0FB27425
                                                                          SHA-256:91191517403C712299919F9C797F952502E33CB6961D1DBEE3A7C9E8D2B170B9
                                                                          SHA-512:881CCAB0950AE993744ECCA141120C005F53D684167A3E5CBDDF950D110D630FB2B4F6AE6E3D0E06D5110AE25EA00A4F4DAFB03AD3B227DC8C63464D434431DA
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\et.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1258
                                                                          Entropy (8bit):4.391217201307309
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83P1Y2+1YoQVTsC/m48qpRTVTR7I/68qqq4Z0yoN7emG5wsvtqmsv5t:43P1p+1jQ9sq8y9v8Yko7emG5wKtqmKX
                                                                          MD5:C8C5EF2FA6DD8DBD5BBD2699BE1A0BF6
                                                                          SHA1:F5E26B40786B8987C98F9CBDEF5522043574A9ED
                                                                          SHA-256:4BEE224C21B0483CFF39BE145C671AA20CB7872C8727FD918C0E8ECA2BBEB172
                                                                          SHA-512:757FA85C137A11C1A3F4A8392C7A4E4030A67D0E593FA25A98BEC07DB295399AB2C0D9EBE61E07420B14387A29C060DC3AF812A1E7B85110DBB13C3C3DCB3600
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \.. "P"\.. "E"\.. "T"\.. "K"\.. "N"\.. "R"\.. "L"].. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \.. "p\u00fchap\u00e4ev"\.. "esmasp\u00e4ev"\.. "teisip\u00e4ev"\.. "kolmap\u00e4ev"\.. "neljap\u00e4ev"\.. "reede"\.. "laup\u00e4ev"].. ::msgcat::mcset et MONTHS_ABBREV [list \.. "Jaan"\.. "Veebr"\.. "M\u00e4rts"\.. "Apr"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "Aug"\.. "Sept"\.. "Okt"\.. "Nov"\.. "Dets"\.. ""].. ::msgcat::mcset et MONTHS_FULL [list \.. "Jaanuar"\.. "Veebruar"\.. "M\u00e4rts"\.. "Aprill"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "August"\.. "September"\.. "Oktoober"\.. "November"\.. "De

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\eu.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1032
                                                                          Entropy (8bit):4.002617252503668
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83DEXk8TT7vXk8TTMtzCIsOo/ssP6tvf1I49sHT:434bTbbTc+RjKi4mz
                                                                          MD5:ED9805AF5BFB54EB28C6CB3975F86F5B
                                                                          SHA1:2BD91BD850028712F35A2DDB2555036FBF6E8114
                                                                          SHA-256:6889B57D29B670C6CFB7B5A3F2F1749D12C802E8E9629014D06CE23C034C7EF1
                                                                          SHA-512:16F31DE5D2B0D3ED2D975C7891C73C48F073CDAC28F17572FC9424C2D384DDFE9E5E235F17C788F42840CB2D819D2D9499B909AB80FEF1B09F2AE1627CF1DADC
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu MONTHS_ABBREV [list \.. "urt"\.. "ots"\.. "mar"\.. "api"\.. "mai"\.. "eka"\.. "uzt"\.. "abu"\.. "ira"\.. "urr"\.. "aza"\.. "abe"\.. ""].. ::msgcat::mcset eu MONTHS_FULL [list \.. "urtarrila"\.. "otsaila"\.. "martxoa"\.. "apirila"\.. "maiatza"\.. "ekaina"\.. "uztaila"\.. "abuztua"\.. "iraila"\.. "urria"\.. "azaroa"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\eu_es.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):294
                                                                          Entropy (8bit):4.915392589807169
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoszFnJF+l6VvBoszw3vLjoszw3v6mjosz++3v/RHvn:4EnLB383FL+l6VQ3vO3v6G3vZPn
                                                                          MD5:4C91AA000D4316585893025CBB96E910
                                                                          SHA1:3D4E73839A1A8CB9DEC1E59D9D2813257D9480F0
                                                                          SHA-256:D45CC432E5743E6CEC34E9A1E0F91A9D5C315CDA409E0826B51AD9D908479EB6
                                                                          SHA-512:0731F2EEB22ADC7EF8AF215B9EB4C5A66B33BC90E4F80CF7AA482AD002CB30543547230124A0507EC79EDDD6903A042EDA5D7C8AFD77F7FC994EFC6853FABB05
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da".. ::msgcat::mcset eu_ES TIME_FORMAT "%T".. ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T".. ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fa.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1711
                                                                          Entropy (8bit):4.21837106187395
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83CnMqnbxbGwgjSyiY/Xw2mS1yM/8ye48YyfNqTb2gyj/8yHkQp:43Yzyhgvs9yi4P
                                                                          MD5:7AB25F4E7E457469DC61A33176B3AA72
                                                                          SHA1:EEA98283D250A99E33DD4D5D9B1B76A029716CE6
                                                                          SHA-256:86898728B275288693B200568DC927C3FF5B9050690876C4441A8339DAE06386
                                                                          SHA-512:7524437F91E91751BEB7A378D7674C49E5D84B716FE962F4C23580C46A671F3F33638FCD37A8F90C86E24DA8F54448E06AC9C3AEFFB5613E94A04E512C1AD68D
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0648\u062a

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fa_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2009
                                                                          Entropy (8bit):4.491667766230948
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83KnMqnbxbGUgjDiY/Xw2mS1yM/8ye48tfNqTb2gyj/8yHkQLoRv9v/vNv0P:43wihgvsai4Rmv53JU
                                                                          MD5:C59EE7CA80AD9F612A21C8B6674A820E
                                                                          SHA1:AEFD631EFC1892063244FA622DE1A091C461E370
                                                                          SHA-256:6B56545C1AE1DE53BC2389BB7AE59F115BADE24F907E384E079491DC77D6541D
                                                                          SHA-512:42F52091480599D317FB80DF8E52A6C6F88614C6172BF4033974DD136FB30E6F47D38982C8A7BC14CF3165C3EBAE3680F94DF3A0ED079AB68165286251CD0BD7
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fa_ir.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):426
                                                                          Entropy (8bit):5.12739029869254
                                                                          Encrypted:false
                                                                          SSDEEP:12:4EnLB383D2WGz7A/3vy3v6TANCmK3vz7AAbn:4aR83DoPivkvFk5vPN
                                                                          MD5:9778A7C3ABD37ECBEC0BB9715E52FAF8
                                                                          SHA1:D8063CA7779674EB1D9FE3E4B4774DB20B93038B
                                                                          SHA-256:3D9779C27E8960143D00961F6E82124120FD47B7F3CB82DB3DF21CDD9090C707
                                                                          SHA-512:B90B4A96CE5E8B9BF512B98C406603C60EA00F6740D04CD1FC30810C7155A37851AE5E28716F959137806F1A9E3152D2A0D79B8EA7E681A0737A28593657DE66
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d".. ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631".. ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y".. ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H".. ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P".. ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fi.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1195
                                                                          Entropy (8bit):4.32217771842326
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83KTvIhmuw4tW/UWJTttWKeqA+3ewvtyv3e6:43YvIwuw4t05ttnlzt0p
                                                                          MD5:CC06F0ABD8F985654DAD8256598EBCB7
                                                                          SHA1:71C880F9F395ACD32AF7F538033211F392F83645
                                                                          SHA-256:9929A6B7139BD7E0F29487F7888A83E4C4F5E9CE0352738CFCA94EE2DDF3BD6B
                                                                          SHA-512:E1292665270B6FBF7738CC3864B55194E7B827C6AD9492FB2E54DC1B626159B243052CE502335B9D92E2B8F58A4DD1FA0E628CB6A9D1D3A652FE2B93A3FB711A
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "ma"\.. "ti"\.. "ke"\.. "to"\.. "pe"\.. "la"].. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \.. "sunnuntai"\.. "maanantai"\.. "tiistai"\.. "keskiviikko"\.. "torstai"\.. "perjantai"\.. "lauantai"].. ::msgcat::mcset fi MONTHS_ABBREV [list \.. "tammi"\.. "helmi"\.. "maalis"\.. "huhti"\.. "touko"\.. "kes\u00e4"\.. "hein\u00e4"\.. "elo"\.. "syys"\.. "loka"\.. "marras"\.. "joulu"\.. ""].. ::msgcat::mcset fi MONTHS_FULL [list \.. "tammikuu"\.. "helmikuu"\.. "maaliskuu"\.. "huhtikuu"\.. "toukokuu"\.. "kes\u00e4kuu"\.. "hein\u00e4kuu"\.. "elokuu"\.. "syyskuu"\.. "lokakuu"\.. "marraskuu"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fo.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1033
                                                                          Entropy (8bit):4.15884265510429
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR834YPxTSBFSa+E6rIsmYmyAxyIQbXHU92W1T:43a6rIyAE0B
                                                                          MD5:5D224E66FD9521CA4327D4F164CD6585
                                                                          SHA1:FC8F4C1D9A69931679028DE02155D96A18F6542E
                                                                          SHA-256:2EC9B03469FA38B260915C93318F446EA5E12B9090BD441936B57552EBA1E3C9
                                                                          SHA-512:0E0F97D99F0274A8A92AA7DC992B252A0BB696D69A8835602D8F4C03A6A15780F45971F00863436949CD81AD7DF6EE6BC463CE5B9FECF5E39508BA4D4E83C693
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \.. "sun"\.. "m\u00e1n"\.. "t\u00fds"\.. "mik"\.. "h\u00f3s"\.. "fr\u00ed"\.. "ley"].. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nadagur"\.. "t\u00fdsdagur"\.. "mikudagur"\.. "h\u00f3sdagur"\.. "fr\u00edggjadagur"\.. "leygardagur"].. ::msgcat::mcset fo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset fo MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "apr\u00edl"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fo_fo.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.864028070948858
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoZA4WjoZd3vLjoZd3v6mjoZd+3vnFDoAkvn:4EnLB3831P23vS3v6u3v9dmn
                                                                          MD5:92E2B6483B2374817548F4EAA1731820
                                                                          SHA1:071E1E9368CCB4EC864E78622B2113F460920203
                                                                          SHA-256:C3DCCF5E5904C24D4AD9AAA36160A78F5397A7452510C0C0E61DE4DE863305CB
                                                                          SHA-512:E79D4D38A22298252FA46D15C383CFB2A1E49E8196C265A58F9BA4982DFD9CE29E87C0B85BE3F39617359451831B792FCD3092A52EDF8FFD999AFE5CFE1D170D
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y".. ::msgcat::mcset fo_FO TIME_FORMAT "%T".. ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T".. ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1257
                                                                          Entropy (8bit):4.383721663740675
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR835LzAX2t6KOkPwzZIGzRmzQf1waGqHvivh:43mlwIFZtA/qPkh
                                                                          MD5:4D63B4A7CF13A28A6F6784B5597EEF43
                                                                          SHA1:FE1B35A93CB72666D7D6BC37D9BE081B05A00CD9
                                                                          SHA-256:96B1E1E12CD13A56722EBF27D362C70B467342FA1282A40B89FB16B5105A0480
                                                                          SHA-512:5647CAE859B62C7CE1CEE6426A076361D2A29EFE6B6F311DDC0E7D006194BA68D575852FEC5FDE2AB43DF8AE440C57013D32A3951095CB856327070FD9BD1C76
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \.. "dim."\.. "lun."\.. "mar."\.. "mer."\.. "jeu."\.. "ven."\.. "sam."].. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \.. "dimanche"\.. "lundi"\.. "mardi"\.. "mercredi"\.. "jeudi"\.. "vendredi"\.. "samedi"].. ::msgcat::mcset fr MONTHS_ABBREV [list \.. "janv."\.. "f\u00e9vr."\.. "mars"\.. "avr."\.. "mai"\.. "juin"\.. "juil."\.. "ao\u00fbt"\.. "sept."\.. "oct."\.. "nov."\.. "d\u00e9c."\.. ""].. ::msgcat::mcset fr MONTHS_FULL [list \.. "janvier"\.. "f\u00e9vrier"\.. "mars"\.. "avril"\.. "mai"\.. "juin"\.. "juillet"\.. "ao\u00fbt"\.. "septembre"\.. "octobre"\.. "novembre"\.. "d\u00e9cembre

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fr_be.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.910112619660625
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoXqyFjoIX3vLjoIX3v6mjog+3vnFDoAkvn:4EnLB383AqWv3vL3v6d3v9dmn
                                                                          MD5:07EEADB8C2F2425FF9A27E46A81827A2
                                                                          SHA1:AA18A651C64098C7885F1F869B9F221453F42987
                                                                          SHA-256:AAD828BCBB512FBD9902DCDD3812247A74913CC574DEB07DA95A7BBE74B1FE48
                                                                          SHA-512:1FA60B1A69B2F5FD2C009EC18695A937C4484D7C418F7E8398D95723B857698143E0584A546F9032B75894730CBBEF78453061AC13D90199FF702E148D983C28
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset fr_BE TIME_FORMAT "%T".. ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fr_ca.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.890376345610709
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xooIso13vLjo13v6mjo1+3vnFDoAkvn:4EnLB383vIF3vU3v6A3v9dmn
                                                                          MD5:2F70BDDE7685E2892C5F79C632FC2F0F
                                                                          SHA1:FD1A6F6042E59D1563ABB5858C348C1D785C435E
                                                                          SHA-256:0624DF9A56723DDB89E59736C20A5837DEA2206A789EBE7EEF19AD287590CA45
                                                                          SHA-512:50FC0C91AB2C75FFC4F100C0D42DFC4B2101DB9713FD77E6FF5BF3F25A0AF4A535A4709CF4586809CEEE76C25B66ABC0DD4FD61524510C57AA0E63EA8F46E8D5
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset fr_CA TIME_FORMAT "%T".. ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\fr_ch.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):288
                                                                          Entropy (8bit):4.913241133684606
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoFt28oF+3vLjoF+3v6mjo++3vnFDoAkvn:4EnLB383yte+3vs+3v6/3v9dmn
                                                                          MD5:83FC7EBA68C3727F7C13C8EEAF79823F
                                                                          SHA1:81C27F9B97F5F5190F7189230535EC09CD228158
                                                                          SHA-256:290CA6EB74BAEAC4E2420D0755D148849F89EE87E37860F25CBB7B8AFA3EDCBC
                                                                          SHA-512:35DA46558A246D7B3FAB02208001CE986E2E6DD88D6318AF743F4E81CA6920471D1425BB009A7476A79E7F61E1353C027B765331CD8EFA07A9E884DCB73F2195
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y".. ::msgcat::mcset fr_CH TIME_FORMAT "%T".. ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ga.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1188
                                                                          Entropy (8bit):4.314271783103334
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR835k0CM/hlrXa754pD73/tKSx54pbIK5f2CA:43W05rXUa173/VadDA
                                                                          MD5:67D137E5D853DB61A4B4264871E793F7
                                                                          SHA1:4280E7F662DE792175AF8B4C93874F035F716F0F
                                                                          SHA-256:880806867ACABD9B39E3029A5ADD26B690CC5709082D43B0959EBA725EA07AB5
                                                                          SHA-512:C27B745143539D3E6D94BB754DCA35065CDE9B1AA6EE038D47F658175CFACC20236124D38BE5BBB03CAF8F613BD748C43CB8DFCC9234E915D18B5A477BAEF94E
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \.. "Domh"\.. "Luan"\.. "M\u00e1irt"\.. "C\u00e9ad"\.. "D\u00e9ar"\.. "Aoine"\.. "Sath"].. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \.. "D\u00e9 Domhnaigh"\.. "D\u00e9 Luain"\.. "D\u00e9 M\u00e1irt"\.. "D\u00e9 C\u00e9adaoin"\.. "D\u00e9ardaoin"\.. "D\u00e9 hAoine"\.. "D\u00e9 Sathairn"].. ::msgcat::mcset ga MONTHS_ABBREV [list \.. "Ean"\.. "Feabh"\.. "M\u00e1rta"\.. "Aib"\.. "Beal"\.. "Meith"\.. "I\u00fail"\.. "L\u00fan"\.. "MF\u00f3mh"\.. "DF\u00f3mh"\.. "Samh"\.. "Noll"\.. ""].. ::msgcat::mcset ga MONTHS_FULL [list \.. "Ean\u00e1ir"\.. "Feabhra"\.. "M\u00e1rta"\.. "Aibre\u00e1n"\.. "M\u00ed na Bealtaine"\.. "Meith"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ga_ie.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.824539027053997
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xobHAygDobHAqo+3vLjobHAqo+3v6mjobHAy9+3vnFDoAkv:4EnLB383p23vy3v6a3v9dmn
                                                                          MD5:C27BD7F317AAADB380F4C38AE0D2FDA6
                                                                          SHA1:79870A0E68AA0A9B301414EDC21889F83BB81E40
                                                                          SHA-256:3F9615C617D3CDBC1E127B3EFEE785B0CB5E92E17B7DABAC80DA2BEAF076362C
                                                                          SHA-512:3605B9A914284CF1D3CC90DF2F21A86C0472AEE59800942DC93D842C7AE164E1DA72813787F163DC80B72269D2C391953ABAD6A8B72CCF069BEE96D418A173E9
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y".. ::msgcat::mcset ga_IE TIME_FORMAT "%T".. ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\gl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):997
                                                                          Entropy (8bit):4.120890519790248
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83okzalCcPdJ5rK8yzMY4JlV1ZDqqIkFo8w:43JkPj9K8y4HHZLIQtw
                                                                          MD5:A3D098C1A47E380F7C25233A52FBDE38
                                                                          SHA1:C97E4EAA9E7A7F99950F422B93C57134B532C639
                                                                          SHA-256:34D61B49DBF9584893051FFB458D6DE9E7E2E7774AC0011F70C4DD4184EBA81C
                                                                          SHA-512:4687AB3D2FAA65FED90678EBC08C074959E93A9FEFAF3D61EEE39DB08FD200CB57C0DDB4DDBF6451FE1EF5E07EA976EDEF830769FF403CE51734129CEF24DA9F
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Lun"\.. "Mar"\.. "M\u00e9r"\.. "Xov"\.. "Ven"\.. "S\u00e1b"].. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Luns"\.. "Martes"\.. "M\u00e9rcores"\.. "Xoves"\.. "Venres"\.. "S\u00e1bado"].. ::msgcat::mcset gl MONTHS_ABBREV [list \.. "Xan"\.. "Feb"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Xu\u00f1"\.. "Xul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset gl MONTHS_FULL [list \.. "Xaneiro"\.. "Febreiro"\.. "Marzo"\.. "Abril"\.. "Maio"\.. "Xu\u00f1o"\.. "Xullo"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Decembro"\.. ""]..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\gl_es.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.886176304042503
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoPhkgMoPxsF3v6ay/5oPhk9+3vR6HyFvn:4EnLB383WrfK3v6ay/WJ3voSVn
                                                                          MD5:78B9163C5E8E5E7049CBF91D1A5889A4
                                                                          SHA1:F2F07AF3D79D61C8E0C73B13E2CA8266E10E396B
                                                                          SHA-256:B5688CA07D713227B713655877710258CD503617E8DF79293A971649E3134F05
                                                                          SHA-512:E86074B687670542CFA097C94D150292E1A73C9F231E92CD84386580A446569CC6F8F5817F46ED64A1D00F95D59F6F1F5D4B961DF3C8335938D83F3517794353
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\gv.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1084
                                                                          Entropy (8bit):4.213672208102291
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR832vTXAC2/fS5JfaCroeLaCAQbSm5qJe1:43QTXs32zrf
                                                                          MD5:518FC3964D50854081FB79189A42D3E7
                                                                          SHA1:59392F16CD56E3E6A685F78974D539FB3A972B98
                                                                          SHA-256:404795F2C88D0038F9ED0B5120A251D26EDF8B236E1B1698BC71ACD4DC75AC45
                                                                          SHA-512:E5C88CAB8741D631938CEC2E0959C0FE26685C395F5F9F4F1B5C9E146E84D23D897CD7A823AB46D4B62C590AE15EC76B87EB59308ACFB1BB6F61398890B43622
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \.. "Jed"\.. "Jel"\.. "Jem"\.. "Jerc"\.. "Jerd"\.. "Jeh"\.. "Jes"].. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \.. "Jedoonee"\.. "Jelhein"\.. "Jemayrt"\.. "Jercean"\.. "Jerdein"\.. "Jeheiney"\.. "Jesarn"].. ::msgcat::mcset gv MONTHS_ABBREV [list \.. "J-guer"\.. "T-arree"\.. "Mayrnt"\.. "Avrril"\.. "Boaldyn"\.. "M-souree"\.. "J-souree"\.. "Luanistyn"\.. "M-fouyir"\.. "J-fouyir"\.. "M.Houney"\.. "M.Nollick"\.. ""].. ::msgcat::mcset gv MONTHS_FULL [list \.. "Jerrey-geuree"\.. "Toshiaght-arree"\.. "Mayrnt"\.. "Averil"\.. "Boaldyn"\.. "Mean-souree"\.. "Jerrey-souree"\.. "Luanistyn"\.. "Mean-fouyir"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\gv_gb.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.936566750568767
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoQbtvMoQLE3v6ay/5oQbto+3vR6HyFvn:4EnLB383PbtvALE3v6ay/PbtF3voSVn
                                                                          MD5:0B6BE614EF5F5F25A30D2D33701A9F94
                                                                          SHA1:65800FBD73D9DAE550E04E1D818A6B9D1AEF86FE
                                                                          SHA-256:86CABF3B9360C0E686CC4CBEB843E971C28BC6D35210ED378B54EB58CC41F3D5
                                                                          SHA-512:376D21B38DA49A8F7C2983F2B808FD55AC9F6383BC66DF28DB99DBF61FDC9FFF8CD20F077EC3ED873EF47F0F613BDD9AD02DFFB1CB51F9A36715C7FC798C3B70
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\he.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1990
                                                                          Entropy (8bit):4.298934047406144
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83Y71LCLxL0eCLbCLKCLaCLXL7CLB0p1dLGCoCLU5LT5Gv5LJ9p5LnLEHLGCh:43sl7KqpU/nNbhbOezd2ICn
                                                                          MD5:A0E60036EB17208A449AAFC3AAAE622C
                                                                          SHA1:9D7479BA85FBB00A2DF2B61F4ED2CBEA8F1EC8C3
                                                                          SHA-256:787DA79AF58872BF45AB09E3B6A920A4496B5BD8A4F3C7F010CF013EC2E8EFE0
                                                                          SHA-512:46D12C14B5736E5EA97EB728BF58999E9D7C2CF910D8F5AFA3F5D3A86329ABF41A3E2BEBD81EE4EF64BEA0DC173B77A9FE12471C1BD9D768ED552A55B3B80213
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \.. "\u05d0"\.. "\u05d1"\.. "\u05d2"\.. "\u05d3"\.. "\u05d4"\.. "\u05d5"\.. "\u05e9"].. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \.. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\.. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\.. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\.. "\u05e9\u05d1\u05ea"].. ::msgcat::mcset he MONTHS_ABBREV [list \.. "\u05d9\u05e0\u05d5"\.. "\u05e4\u05d1\u05e8"\.. "\u05de\u05e8\u05e5"\.. "\u05d0\u05e4\u05e8"\.. "\u05de\u05d0\u05d9"\.. "\u05d9\u05d5\u05e0"\.. "\u05d9\u05d5\u05dc"\.. "\u05d0\u05d5\u05d2"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\hi.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1777
                                                                          Entropy (8bit):4.2117128941697715
                                                                          Encrypted:false
                                                                          SSDEEP:48:438n4kALqrU1fbokQTbWqrU1fbokQTw38:28OD86D8gM
                                                                          MD5:4219A929E27308ADC04A9F368F063F38
                                                                          SHA1:FA728EEBA8751F4CE032ED32AECFDE124D1B68E2
                                                                          SHA-256:192F4A8E77E1627712F85533C9896EF6A040157C7BD56DF3A4A7FA56AD6746C2
                                                                          SHA-512:223B137AC1FC15908F5541067736EF3A29493549B963393EB78660036A82982E57CFC4AD09CBD33D32A5187FF9F4ACFB5F83A0C974702434B7FAD1B2539B7F76
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset hi MONTHS_ABBREV [list \.. "\u091c\u0928\u0935\u0930\u0940"\.. "\u092b\u093c\u0930\u0935\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u0905\u092a\u094d\u0930\u0947\u0932"\.. "\u092e\u0908"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u093e\u0908"\.. "\u0905\u0917\u0938\u094d\u0924"\.. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\.. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\.. "\u0928\u0935\u

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\hi_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.9286948144352865
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xocv+IZoz3v6ry/5oco+3v+6f6HyFvn:4EnLB383Jvlg3v6ry/JF3vmSVn
                                                                          MD5:1C1E1484EA0286175FADCB90937C9F34
                                                                          SHA1:5CA1BF19021D529CB3B3A308EFFFCA7E4D073640
                                                                          SHA-256:5A3BF0DD61BFB5A2BF75E96B11E0E3528FFAB720A0BF1923853606F8CAF0E76D
                                                                          SHA-512:F9A43E1E18ADB6DC6B18BEDC3303A99F514DF6CA54F12100989F734233012D7D60216116915351CCACC12F6942795BF8F3BBD26B15A86E88101067D64BEE54F5
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\hr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1171
                                                                          Entropy (8bit):4.36311224714184
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83dVX79VIE9bLTWnh7rT+5dPcdvgrNv5KvOA1:43kmrQ7n+odIrJ6OS
                                                                          MD5:906963A3AD09EAC781B35C190B77484E
                                                                          SHA1:E5AA49DA9C4987EAFA839115F84612426EB8615E
                                                                          SHA-256:105A9180BC5D23738183374FA0EA8DD80484BF3947E1432E515BDC2913C017D9
                                                                          SHA-512:557BD1C8306750D09215D9774069A52C7D60E03DE2DF39FF909A8F658AB0565739D127E24ACDC96F736C69A71BEFA30B8A30BB489C7B7FDEA85386C802166349
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \.. "ned"\.. "pon"\.. "uto"\.. "sri"\.. "\u010det"\.. "pet"\.. "sub"].. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \.. "nedjelja"\.. "ponedjeljak"\.. "utorak"\.. "srijeda"\.. "\u010detvrtak"\.. "petak"\.. "subota"].. ::msgcat::mcset hr MONTHS_ABBREV [list \.. "sij"\.. "vel"\.. "o\u017eu"\.. "tra"\.. "svi"\.. "lip"\.. "srp"\.. "kol"\.. "ruj"\.. "lis"\.. "stu"\.. "pro"\.. ""].. ::msgcat::mcset hr MONTHS_FULL [list \.. "sije\u010danj"\.. "velja\u010da"\.. "o\u017eujak"\.. "travanj"\.. "svibanj"\.. "lipanj"\.. "srpanj"\.. "kolovoz"\.. "rujan"\.. "listopad"\.. "studeni"\.. "prosinac"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\hu.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1381
                                                                          Entropy (8bit):4.511450677731002
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83IFb7ZTmKrkAYm2LZyyApLDV2uZi5WF+shHUTyvtsv+:43C3ZTmKQAyZyyAp0BotK+
                                                                          MD5:E398158EE1CD49CB5286D9642D4A61DD
                                                                          SHA1:A93A588B0ADD198C067C4BB070DC1E5170E6E208
                                                                          SHA-256:993475532F89E1EA7214ADB265294040862305612D680CFF01DD20615B731CCC
                                                                          SHA-512:9E5791FB97110FE5F7A1F49FF2ED8801A05E49D5B9AF579474C0081073D2B40ECFFE6E4EB5B61F12B1995FDCC0A557CB572E5E116F951FD286A6254253DAEC01
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \.. "V"\.. "H"\.. "K"\.. "Sze"\.. "Cs"\.. "P"\.. "Szo"].. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \.. "vas\u00e1rnap"\.. "h\u00e9tf\u0151"\.. "kedd"\.. "szerda"\.. "cs\u00fct\u00f6rt\u00f6k"\.. "p\u00e9ntek"\.. "szombat"].. ::msgcat::mcset hu MONTHS_ABBREV [list \.. "jan."\.. "febr."\.. "m\u00e1rc."\.. "\u00e1pr."\.. "m\u00e1j."\.. "j\u00fan."\.. "j\u00fal."\.. "aug."\.. "szept."\.. "okt."\.. "nov."\.. "dec."\.. ""].. ::msgcat::mcset hu MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "m\u00e1rcius"\.. "\u00e1prilis"\.. "m\u00e1jus"\.. "j\u00fanius"\.. "j\u00falius"\.. "augusztus"\.. "szeptembe

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\id.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):961
                                                                          Entropy (8bit):4.02166638427728
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83dcTcWKutdXaMmEfc2ftdT2dHblWZ0VT:43dQrKutdntdI8g
                                                                          MD5:191ACF2E8A8F10A1360B283D42886382
                                                                          SHA1:EE2C00D021381EA638B6CE3F395DEA5F8491ED9B
                                                                          SHA-256:41C0C3D3B4491E9B36E719466503EFCD325175CB7824C4A5055CB113D347BE0F
                                                                          SHA-512:29BC4F7D3FAE7DE392B175FEA76138FA823B7D9D0B051A19A73F7D36D51DE34E0D0C7C129867307ABF51FC92E70853C15BD96B8484AD21EAB0A8EB83B0411E03
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \.. "Min"\.. "Sen"\.. "Sel"\.. "Rab"\.. "Kam"\.. "Jum"\.. "Sab"].. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \.. "Minggu"\.. "Senin"\.. "Selasa"\.. "Rabu"\.. "Kamis"\.. "Jumat"\.. "Sabtu"].. ::msgcat::mcset id MONTHS_ABBREV [list \.. "Jan"\.. "Peb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Agu"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset id MONTHS_FULL [list \.. "Januari"\.. "Pebruari"\.. "Maret"\.. "April"\.. "Mei"\.. "Juni"\.. "Juli"\.. "Agustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""]..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\id_id.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.904408530699153
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo0kGMo0F/W3v6ay/5o0kT+3vR6HyFvn:4EnLB383wG33v6ay/wK3voSVn
                                                                          MD5:FEB4D50576BF3E11A0A40FD29ABE35A7
                                                                          SHA1:8CEAA187C8AA5EC101743060A877D039850964CA
                                                                          SHA-256:BA7FC0C0452D3E482DB6E19BDF512CACED639BA72B92ED8F66D80B52FEA11AC0
                                                                          SHA-512:8B5D18E3D6628F369FB387C8EF08CC80000E0CBE500972958F4AD75F1C2F0DD6058F9777BD7DD0D7C26E7ECAA65E5071E2BF51B560973E88637942116C7576FB
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y".. ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\is.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1305
                                                                          Entropy (8bit):4.457417703528286
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83XVhVTeMVHGPbfXSmWzaZlfFxUQbW1U6ZY95n123etvmv3eTn:43Xz0b/uzaZtXUMw8n
                                                                          MD5:ACF0452D5BB6D36A40061D2B0AF4D7A6
                                                                          SHA1:9DF4D88F1962A672EFBDDE524550F7A5D02D446D
                                                                          SHA-256:778BE3D6BFE2DFFB64FF1AFB9EC8351A3343B314CF93A68E8F7FD1073EE122BB
                                                                          SHA-512:34CC02D7D28B5E161ED10250C214375561FD3D00979BFB8BCF3DB72A81BD9B7C225301528B400F7C54D8B6379F772EB6477D5D03F2CF7DC4DD19D22AEEC151B5
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \.. "sun."\.. "m\u00e1n."\.. "\u00feri."\.. "mi\u00f0."\.. "fim."\.. "f\u00f6s."\.. "lau."].. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nudagur"\.. "\u00feri\u00f0judagur"\.. "mi\u00f0vikudagur"\.. "fimmtudagur"\.. "f\u00f6studagur"\.. "laugardagur"].. ::msgcat::mcset is MONTHS_ABBREV [list \.. "jan."\.. "feb."\.. "mar."\.. "apr."\.. "ma\u00ed"\.. "j\u00fan."\.. "j\u00fal."\.. "\u00e1g\u00fa."\.. "sep."\.. "okt."\.. "n\u00f3v."\.. "des."\.. ""].. ::msgcat::mcset is MONTHS_FULL [list \.. "jan\u00faar"\.. "febr\u00faar"\.. "mars"\.. "apr\u00edl"\.. "ma\u00ed"\.. "j\u00fan\u00ed"\.. "j\u00fal\

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\it.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1294
                                                                          Entropy (8bit):4.282101355195382
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83JYEVI2vfYpQjAOnhWBIIsmdC2lkOKk+Z+FoPJ6G3vesvY:43JZVB8eAOnh4IzR2+J6G/eKY
                                                                          MD5:3354A6FC06C298E33AA14163929E56EB
                                                                          SHA1:C3005370DAE8A266AE21F7E2B871AEA5A656A155
                                                                          SHA-256:1D72170B9F9028A237364F7CD7EA8B48BD4770E61922205CE862300103B13DE5
                                                                          SHA-512:58B64D4F5827CA2A1BF2DDFD1F7EFDDBBD46709A6A9B7277E8EB386D80043A87ADDE2B3D5A49A934E8EB8F797BD735FADA1D22AD3DD856FFE9507F71B9E45CBA
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mer"\.. "gio"\.. "ven"\.. "sab"].. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \.. "domenica"\.. "luned\u00ec"\.. "marted\u00ec"\.. "mercoled\u00ec"\.. "gioved\u00ec"\.. "venerd\u00ec"\.. "sabato"].. ::msgcat::mcset it MONTHS_ABBREV [list \.. "gen"\.. "feb"\.. "mar"\.. "apr"\.. "mag"\.. "giu"\.. "lug"\.. "ago"\.. "set"\.. "ott"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset it MONTHS_FULL [list \.. "gennaio"\.. "febbraio"\.. "marzo"\.. "aprile"\.. "maggio"\.. "giugno"\.. "luglio"\.. "agosto"\.. "settembre"\.. "ottobre"\.. "novembre"\.. "dicembre"\.. "

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\it_ch.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):250
                                                                          Entropy (8bit):4.8982877714191035
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoi5jL/oyJ+3v1oia+3vjLtAsvn:4EnLB383b3F+3vV3v3tnn
                                                                          MD5:E4400C16406A46C2880250522BED2EDE
                                                                          SHA1:787A04037A355FF845025B8865335EB938280BFB
                                                                          SHA-256:24B5F303F5C7AF6F63FDC23ADB4D713087AE74B6D18C117D787AF03374C5F57E
                                                                          SHA-512:3551DEEF0EAAC66042143F77F2F4DD9154764F35BD624DAB3C9F0F59F3489CA39CE34BC2A69BC5BFBB1926C6F5C39D74A806ECB1A47F6B374101071957FD417B
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y".. ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ja.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1689
                                                                          Entropy (8bit):4.951012555106795
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83Gl84OCtnbf3wvtMwvLv4GTwhvevTwSoXghGhD6h:43FULWttbdEVoES8gshD6h
                                                                          MD5:11FBE427747012444AEEAFD6134034A4
                                                                          SHA1:58C72C432053264EAE6335D6CC93C5FFA33C42B8
                                                                          SHA-256:2B6D15A191437F1B84FA7023E34153B61E6BF1DE1452EA921E9CCBBE5D4BEB1C
                                                                          SHA-512:4F993BDF5D50D6D9F7410C83D226FEF30BA8C989F9977A7025C36BE22CEECCD6C68CDD6AFC5C9CE3D700559C4EDC619042E14DD88EE7583B9D5AA66F0268FD23
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u6708"\.. "\u706b"\.. "\u6c34"\.. "\u6728"\.. "\u91d1"\.. "\u571f"].. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \.. "\u65e5\u66dc\u65e5"\.. "\u6708\u66dc\u65e5"\.. "\u706b\u66dc\u65e5"\.. "\u6c34\u66dc\u65e5"\.. "\u6728\u66dc\u65e5"\.. "\u91d1\u66dc\u65e5"\.. "\u571f\u66dc\u65e5"].. ::msgcat::mcset ja MONTHS_FULL [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"].. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d".. ::msgcat::mcset ja CE "\u897f\u66a6".. ::msgcat::mcset ja AM "\u5348\u524d".. ::msgcat::mcset ja PM "\u5348\u5f8c".. ::ms

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\kl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1025
                                                                          Entropy (8bit):4.097746630492712
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83E7XIE/OWbjH3Tw2PzJrIsmZ5maAXaMHPB:43WlrraA/vB
                                                                          MD5:2F79804667D6F8C77BB188D59EF5F3DF
                                                                          SHA1:10950ECA798F24A7C405B3E18B559CCC0C056EC1
                                                                          SHA-256:96FF17F1CFF976E4E204D3616D1EFCED4D0F907C5E6A0F04B4536CB4AD1190C9
                                                                          SHA-512:1B8ADC3B7FF920F8F53A17BFCC7EA24A0F8E276A42E5C63F9880DAE9B74E12716DD12DB647A80A9D99294449146C643EC58A33B03681AA4FA26A5FBC508C248C
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \.. "sab"\.. "ata"\.. "mar"\.. "pin"\.. "sis"\.. "tal"\.. "arf"].. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \.. "sabaat"\.. "ataasinngorneq"\.. "marlunngorneq"\.. "pingasunngorneq"\.. "sisamanngorneq"\.. "tallimanngorneq"\.. "arfininngorneq"].. ::msgcat::mcset kl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset kl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "martsi"\.. "aprili"\.. "maji"\.. "juni"\.. "juli"\.. "augustusi"\.. "septemberi"\.. "oktoberi"\.. "novemberi"\.. "dece

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\kl_gl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.882476709336307
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoEpb53FuoEpLE3vLjoEpLE3v6mjoEpba+3vnFDoAkvn:4EnLB383jF3Fyw3vxw3v6A/3v9dmn
                                                                          MD5:255830678C8724E65C05A7E020E68B5B
                                                                          SHA1:0AEA48AB0439C04F92B5CA9A3B5182718B7F116B
                                                                          SHA-256:3027CFE9EBD2172CEFC15C025786CAD47A6E2894BF0474AFC1B0C341E70202AA
                                                                          SHA-512:99039FFA7269DD136D1693121E261DB5586E86EC401D2B1EB8FB1D13A9A7F1E514D9FC941B838286B986C02ED281828ED67E59002D837E350A64F4832340516A
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y".. ::msgcat::mcset kl_GL TIME_FORMAT "%T".. ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T".. ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ko.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1621
                                                                          Entropy (8bit):4.612163420716489
                                                                          Encrypted:false
                                                                          SSDEEP:48:43fMlylslXlslxl1hVuqLGuqqntH4xUyw9:2fKYqVq3f
                                                                          MD5:CCB2C2254D3FA3025183DB7E010CAD66
                                                                          SHA1:510BBB6A9162F2EF908E6561CC714848C2EA74CA
                                                                          SHA-256:EF6FB319C398EEA79B3A951319F831F3B186D556565D17D738E5F9B4B77570F2
                                                                          SHA-512:A0264565899BD1B0783ADC0388F893CCE713ADB23BDD63907CF092A74ACB4F7D3BE09DA29801E9C11A7B08CB1706E3771C598ACED351A0FCCBF4EBBD7871148D
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \.. "\uc77c"\.. "\uc6d4"\.. "\ud654"\.. "\uc218"\.. "\ubaa9"\.. "\uae08"\.. "\ud1a0"].. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \.. "\uc77c\uc694\uc77c"\.. "\uc6d4\uc694\uc77c"\.. "\ud654\uc694\uc77c"\.. "\uc218\uc694\uc77c"\.. "\ubaa9\uc694\uc77c"\.. "\uae08\uc694\uc77c"\.. "\ud1a0\uc694\uc77c"].. ::msgcat::mcset ko MONTHS_ABBREV [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\.. "7\uc6d4"\.. "8\uc6d4"\.. "9\uc6d4"\.. "10\uc6d4"\.. "11\uc6d4"\.. "12\uc6d4"\.. ""].. ::msgcat::mcset ko MONTHS_FULL [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ko_kr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):354
                                                                          Entropy (8bit):5.058233326545794
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo56SFZhjAo56m5Ys5o56TGMovBo56a/W3v6mfKo56TT+3+:4EnLB383g62vjV6m5Ysg6TG26a+3v6oo
                                                                          MD5:58CA45CE26AF8ECA729BA72898BB633D
                                                                          SHA1:CBBEDB7370890A1DB65080A359A9A5C164B525D5
                                                                          SHA-256:4CAC8FB43D290A63A4D3215F22228B358AB4FA174F08712DD6C5B64C5E485071
                                                                          SHA-512:48CCBD3F7B96D0998B6D1A1F8D7FE2B4B070BB5B8809FABE0A38209AEAF2E95E098292A5B9B5F0954E7729708A2173D32AAD70B6C0F336DB1E9BFA2968E6A56B
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804".. ::msgcat::mcset ko_KR CE "\uc11c\uae30".. ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d".. ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S".. ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\kok.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1997
                                                                          Entropy (8bit):4.202940482570495
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83cm48Vc7VczMmDNVcYVcR0prdSmS68FeDJVcYVcR0prdSmS68FeuT:4354a+0prjS68mq0prjS68pT
                                                                          MD5:67FA08F588A3B44D67E42EC1025013BC
                                                                          SHA1:6895FEF0476DE0349895DB052B335AC46636B23A
                                                                          SHA-256:9D215E31A39FED45B3657144E5F73C942E59E500036CE16B1FFF201FD6358595
                                                                          SHA-512:4C2708BD9DD98320D3133EEFFD19A8018F49A36AB8348DB7C0B0287ADB4C052D3EFAD3686C8E46E0520F3CE27F361978272BA8752EB04E5A7BC07780398480DB
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \.. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset kok MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\kok_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):260
                                                                          Entropy (8bit):4.904340548436718
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo5VsNv+IZo5VsU3v6ry/5o5VsNo+3v+6f6HyFvn:4EnLB383gVsNvlAVsU3v6ry/gVsNF3vj
                                                                          MD5:0AA20289A63BA3A14DCFED75EED980DE
                                                                          SHA1:2B76013593D886B0724D82849FD1840B20922902
                                                                          SHA-256:644F2B6D4BA27AF14891B781DEF60F708A9F18FC2F73566649B631A6DEA3EF09
                                                                          SHA-512:6E13E0DC8BFD2ABE0D04B0BC098C40972F088F8D3D6ACA00338B17473ABC6F69840A88EC0C965C493B4270DEC777A0EA2D762BC33044EFE7030E437604EE201B
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\kw.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1013
                                                                          Entropy (8bit):4.060027087416375
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83no1UwRlw4MAwBdc//3rpF6HFoot8:43vglHM7MTCHFs
                                                                          MD5:CCEC7B77DCA1F6A406311FC43EE57030
                                                                          SHA1:4ED329BB09A8F7C67F8984CD790E9B6819DE6F00
                                                                          SHA-256:EAB468AC5BF1833D4F8CD658789413D4A46CAD16B63FB9B906CFF6DC9EA26251
                                                                          SHA-512:4EFF6E49CC479A1BF0CEEAE256A1FAE7D4AE7D0ACE23CD87851471EC96BB5AF580C58A142E1B6CE72BC8B6BFF946A38801E681443B7DD9527A1DEB6E7EDD7D22
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \.. "Sul"\.. "Lun"\.. "Mth"\.. "Mhr"\.. "Yow"\.. "Gwe"\.. "Sad"].. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \.. "De Sul"\.. "De Lun"\.. "De Merth"\.. "De Merher"\.. "De Yow"\.. "De Gwener"\.. "De Sadorn"].. ::msgcat::mcset kw MONTHS_ABBREV [list \.. "Gen"\.. "Whe"\.. "Mer"\.. "Ebr"\.. "Me"\.. "Evn"\.. "Gor"\.. "Est"\.. "Gwn"\.. "Hed"\.. "Du"\.. "Kev"\.. ""].. ::msgcat::mcset kw MONTHS_FULL [list \.. "Mys Genver"\.. "Mys Whevrel"\.. "Mys Merth"\.. "Mys Ebrel"\.. "Mys Me"\.. "Mys Evan"\.. "Mys Gortheren"\.. "Mye Est"\.. "Mys Gwyngala"\.. "Mys Hedra"\.. "Mys Du"\.. "Mys Kevardhu"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\kw_gb.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.959913054070712
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoh6AvMoh633v6ay/5oh6Ao+3vR6HyFvn:4EnLB38346AvR633v6ay/46AF3voSVn
                                                                          MD5:18E8576F63B978F1AFEF15AC57B44FBF
                                                                          SHA1:D50EB90944FF81E3CBFF942B16C1874EB7EA2562
                                                                          SHA-256:EDAC14D929D1C6559EC46E9B460F8F44A189B78FB915F2D641104549CBD94188
                                                                          SHA-512:F3DE5EE77BB889DA1353F9C9A1811083AB28BBEE4B7D6C8782F38B1AE44CF77565371A0E18F7E2BACD7EF590BC1215CA3E41AF929A15F60B3E85F6099A4CF378
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\lt.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1307
                                                                          Entropy (8bit):4.506235846178408
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83iHYuAMLzHYCaNu3d3nT15T31FhAlDgK/YrDZ/6Qz2C9kGPCveksvc:43iHFnHuUd3/T3xM/+SQCC9kGPEekKc
                                                                          MD5:D4EC2E96995E0EB263F338DD16CC4F8D
                                                                          SHA1:7ED86175489B1AE3CA5C0E8D42969F951C895D6B
                                                                          SHA-256:855B652FCC8066BA45C7DC8DBFD3807D1B4759EA8D71C523567F47BF445D1DE6
                                                                          SHA-512:A55E0D759A22360FF6668CEFAFFB812BABB316C447ADDB1FD5CDBC06AE1DA2E891E09952D073164C013AD9BF4184614102E7ADA553EEEFB2BBA26208B79B277F
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \.. "Sk"\.. "Pr"\.. "An"\.. "Tr"\.. "Kt"\.. "Pn"\.. "\u0160t"].. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \.. "Sekmadienis"\.. "Pirmadienis"\.. "Antradienis"\.. "Tre\u010diadienis"\.. "Ketvirtadienis"\.. "Penktadienis"\.. "\u0160e\u0161tadienis"].. ::msgcat::mcset lt MONTHS_ABBREV [list \.. "Sau"\.. "Vas"\.. "Kov"\.. "Bal"\.. "Geg"\.. "Bir"\.. "Lie"\.. "Rgp"\.. "Rgs"\.. "Spa"\.. "Lap"\.. "Grd"\.. ""].. ::msgcat::mcset lt MONTHS_FULL [list \.. "Sausio"\.. "Vasario"\.. "Kovo"\.. "Baland\u017eio"\.. "Gegu\u017e\u0117s"\.. "Bir\u017eelio"\.. "Liepos"\.. "Rugpj\u016b\u010dio"\.. "Rugs\u0117jo"\.. "Spa

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\lv.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1271
                                                                          Entropy (8bit):4.460631492946299
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83Amshb4mZdA7nl9kMmfpK269rkbi5vWm0W9ARivirXsv05vkn:430bHA7XRr95QWQQgaKkn
                                                                          MD5:554ED2CAFD25F5F82DA54AE057F4BA98
                                                                          SHA1:E25CDF0F9C4B523B5B05408E7820F7B4F627D19E
                                                                          SHA-256:7E90D2008B220DB19C796C7107AD69D263B8AC8C7BDDFB879230699D978E9A0A
                                                                          SHA-512:612201CCD64A51EC943921196D8C74D8BCA3AB3E35B0C9E91AE7F3A6B36F4F255AA9ADB3A254EC03629B01BD221B0B3F8CC4DFBFAC1F1718775E81CAD188AA86
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \.. "Sv"\.. "P"\.. "O"\.. "T"\.. "C"\.. "Pk"\.. "S"].. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \.. "sv\u0113tdiena"\.. "pirmdiena"\.. "otrdiena"\.. "tre\u0161diena"\.. "ceturdien"\.. "piektdiena"\.. "sestdiena"].. ::msgcat::mcset lv MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maijs"\.. "J\u016bn"\.. "J\u016bl"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset lv MONTHS_FULL [list \.. "janv\u0101ris"\.. "febru\u0101ris"\.. "marts"\.. "apr\u012blis"\.. "maijs"\.. "j\u016bnijs"\.. "j\u016blijs"\.. "augusts"\.. "septembris"\.. "oktobris"\.. "novembris"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\mk.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2157
                                                                          Entropy (8bit):4.299300188052441
                                                                          Encrypted:false
                                                                          SSDEEP:48:4389QMsGqdQfRQPjQmofqJp9sk5BstSpWQiQ3QJQ5QL39I0QRQTQ8Ql4J8W:2W8SMq+9sWINi2Kc9I0+gXF
                                                                          MD5:888014F13A82511ABEF99497A753BFC3
                                                                          SHA1:7F4231BEDE191370B37E8B917B6AD8829D15CA7D
                                                                          SHA-256:4C0EB07F0FCB36DD12A3F7EDD6531616611ABF62BF7705B5A37CC59098221D5D
                                                                          SHA-512:D748127CC615584901D35B6492EC566448B6C4DA6363858B5145921E9CD09490355CF4315F0F7A8542AA12790CD3432011A643A3A8F74B0119DB0DCE19FD68A4
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0435\u0434."\.. "\u043f\u043e\u043d."\.. "\u0432\u0442."\.. "\u0441\u0440\u0435."\.. "\u0447\u0435\u0442."\.. "\u043f\u0435\u0442."\.. "\u0441\u0430\u0431."].. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0435\u043b\u0430"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\.. "\u043f\u0435\u0442\u043e\u043a"\.. "\u0441\u0430\u0431\u043e\u0442\u0430"].. ::msgcat::mcset mk MONTHS_ABBREV [list \.. "\u0458\u0430\u043d."\.. "\u0444\u0435\u0432."\.. "\u043c\u0430\u0440."\.. "\u0430\u043f\u0440."\.. "\u043c\u0430\u0458."\.. "\u0458\u0443\u

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\mr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1846
                                                                          Entropy (8bit):4.220147808639664
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR833cXh48Vc7VczfVczPmzNVcYVcR0prdSmS68FezUVcYVcR0prdSmS68FeoV:43K4S+0prjS68Yh0prjS68nV
                                                                          MD5:07F99E0A05083B10F80A4D6867163B23
                                                                          SHA1:B6036C7DA8043E3401583D03831E7A4BF755D93D
                                                                          SHA-256:AE873BF5484EACBBE179913D43451BE53378FA701B5D81594D052266B8A09AF0
                                                                          SHA-512:3A032C81B8FBFEE6EB66C1538CBD16329A1B393E4684B4E9B3FBCDD6344CE8AD34FA699F76EF953B3EB597D8E253345F54C2E92E7A43611C721038BCC2471EA2
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset mr MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\u091f\u0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\mr_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.89440333975705
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoGNv+IZoGU3v6ry/5oGNo+3v+6f6HyFvn:4EnLB383Zvlw3v6ry/ZF3vmSVn
                                                                          MD5:67368E8A5715860BABD44E54A168192F
                                                                          SHA1:7790D4B4B28FE5E38AB11CD037FFB826A8EB77FD
                                                                          SHA-256:B7B1D379355A1D278E13EF557A887A662E84FB6A9B62B8E19A27927926270EF9
                                                                          SHA-512:E95C90CFFA7CC4E61026FC328A4AA0BEE6A54A0061BA0B9459F9F0F4B008DD36F81BC9B8D8B964FA051FCEAB7FECE6D107CD456B3FD01A83B4900ECC3A0BCFA4
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ms.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):957
                                                                          Entropy (8bit):4.018924167342869
                                                                          Encrypted:false
                                                                          SSDEEP:12:4EnLB383Zm/aufodZmt+JHEA7UVRosmAL/7Idzr43xRRosuL1PJHWZ6tHhHjv:4aR83ZsauSHJkA7umE/72UD21PJWZ0hT
                                                                          MD5:7E6A943B7D82404F61BDBD95682073CD
                                                                          SHA1:B96DBB1738F293D2842FDCEDF2DEF13004F77A8D
                                                                          SHA-256:970B2F3ECC04980FCC2F9531CA6CE2BF36BC12942CB614BF70313B4CB0508985
                                                                          SHA-512:12F5A5F7A170EE79D1F4398E96FF2DE84472027C5B5003DE7E86F46713E3F0997439E2EBA03FFB7DB611F0CE0E06EB149F5BD08ED2AA0409DB8348867487FFFD
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \.. "Aha"\.. "Isn"\.. "Sei"\.. "Rab"\.. "Kha"\.. "Jum"\.. "Sab"].. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \.. "Ahad"\.. "Isnin"\.. "Selasa"\.. "Rahu"\.. "Khamis"\.. "Jumaat"\.. "Sabtu"].. ::msgcat::mcset ms MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mac"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ogos"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dis"\.. ""].. ::msgcat::mcset ms MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Mac"\.. "April"\.. "Mei"\.. "Jun"\.. "Julai"\.. "Ogos"\.. "September"\.. "Oktober"\.. "November"\.. "Disember"\.. ""]..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ms_my.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):265
                                                                          Entropy (8bit):4.818053174805798
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoChFfluoChF+3v6xyFjoCh++3vflm68vn:4EnLB383xPflwe3v6gZl3vflm6+n
                                                                          MD5:A02F11BE0DF920E63E7A3ACCE746E32D
                                                                          SHA1:4A8B1EF1A6F8A5FD022042D6E009A01E4B0FEBD3
                                                                          SHA-256:F5B859D8DD2A2B5F756E39B0DFEB26B95878D2F54BA3CE46C56F0F26CF2B554B
                                                                          SHA-512:5F9AF8C89F491CB4C158ED73EA4CF32E6A83CF44A94DA6FE1A962C58199BF2348530F3DEFA0C6F433BA3ADEF81AE9B3884F30CD7A841B159D52F9F21008B4F92
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\mt.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):717
                                                                          Entropy (8bit):4.55153350337982
                                                                          Encrypted:false
                                                                          SSDEEP:12:4EnLB383VYmxWHWog4QUbxMmAMMiGZu+3v6ay/GK3vZsSVn:4aR83VYsxonQ2MmVVGRvjCGsvGSV
                                                                          MD5:D8BBEC2F8935054E6081BB5E4AE8F7E3
                                                                          SHA1:33FE6D51A284B8760BC6F442329B10374F506BDA
                                                                          SHA-256:7DBC4E82D82FDE8CDF522FA10E082289D46B0C1A4A7D7A5FA83FF116677F052B
                                                                          SHA-512:BF39C75DD6B3625897D7D44AC253AF5656CA21D0B394F78611584E2606CBC419C4A02353542D23393BEBCCF0CB4D861CDECD61AD89339F78C0260E966B495777
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \.. "\u0126ad"\.. "Tne"\.. "Tli"\.. "Erb"\.. "\u0126am"\.. "\u0120im"].. ::msgcat::mcset mt MONTHS_ABBREV [list \.. "Jan"\.. "Fra"\.. "Mar"\.. "Apr"\.. "Mej"\.. "\u0120un"\.. "Lul"\.. "Awi"\.. "Set"\.. "Ott"\.. "Nov"].. ::msgcat::mcset mt BCE "QK".. ::msgcat::mcset mt CE "".. ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y".. ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\nb.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1209
                                                                          Entropy (8bit):4.313626715960843
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83B0tSYuZrIsmYmPAxyIQ4HU92W16EL3Tvav31:43qhuZrIPAt04yTcF
                                                                          MD5:42D02C3CAF28BE4994F27CEF5A183AB7
                                                                          SHA1:DC411E8AC12C3D588AB2F3A3C95A75D8689AD402
                                                                          SHA-256:534C5DACEF12F818FAF4ED806997A559F95D591F1B6236B0C30B07A107DD13F3
                                                                          SHA-512:0BE27572106324FE2B6CDFF4513500DE7582AD1ABEF451FFC62B2050D3875A149DDDB66451E1B3F5BA9216268E9998D2A1C1E8343BBB9EF97947DA054B82818E
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset nb MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nb MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nb BC

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\nl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1129
                                                                          Entropy (8bit):4.235969198645435
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR837Ed+RxRMZZsmUmnZAEEHM92WFU5vtrvs:43AAHRMZZPnZALsCtt7s
                                                                          MD5:B9B949794203D204628D4DBEA29587AE
                                                                          SHA1:1642D8040144469B5C359E80693E68036F87B849
                                                                          SHA-256:9E2FE3851CF13EC79A9B10A09B01CEB0A26044AE0DC90A4E00BE57745E854C79
                                                                          SHA-512:0CCCCF6D61423CEE0389C3BA1A8E94F2B092C53465D1937F5595AF91E46DD38B318D6C7EE3D88B89F32BFB952C0D55E0E67B46D7DF306ECA6690E283ADEB2CB9
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \.. "zo"\.. "ma"\.. "di"\.. "wo"\.. "do"\.. "vr"\.. "za"].. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \.. "zondag"\.. "maandag"\.. "dinsdag"\.. "woensdag"\.. "donderdag"\.. "vrijdag"\.. "zaterdag"].. ::msgcat::mcset nl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mrt"\.. "apr"\.. "mei"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset nl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "maart"\.. "april"\.. "mei"\.. "juni"\.. "juli"\.. "augustus"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset nl DATE_FORM

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\nl_be.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.865165930946383
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xo4gPPdjog9X3vLjog9X3v6mjo49+3vnFDoAkvn:4EnLB3835gHdPF3vjF3v64I3v9dmn
                                                                          MD5:3261F397ED0291368FF1881E7BA08ECE
                                                                          SHA1:7147ABB62034EB152B1FED9246A533535F07372C
                                                                          SHA-256:77A69DD60D171B321512B14794E75A66FF753410C007997B310790D86E09B057
                                                                          SHA-512:C1526F454FA594DAD056B056F76F01D8B2AB713D04EB2A3643416B8E741B248CC94E000BAEE5B0F60436B88B1216FB1DE7F7C3FA456D4A4FBDE24F97C3B739B8
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y".. ::msgcat::mcset nl_BE TIME_FORMAT "%T".. ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\nn.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1200
                                                                          Entropy (8bit):4.282788574144479
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83tCtrJwuQrIsmYmLAxyIQ4HU92W1W4/3Hv+v31:434suQrILAt0EafIF
                                                                          MD5:985E97517C2BF37719A618F575DF392C
                                                                          SHA1:65BC07FC3A955300ED09B7485F90AEC18CBAD43F
                                                                          SHA-256:06FA2D6D8C59D0B8EAC2EDE5AB0DDB8B6E095D1A023B1966FCE3B65916FA14FB
                                                                          SHA-512:75BC14DBAD147A98D32D2AF0BE0BE50F115BB9C3BBE283B53977B9F264A055734B30F6B1C4EEE9686F1874D178C535111731C92D495B7D370FB17213B65C9A40
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "m\u00e5"\.. "ty"\.. "on"\.. "to"\.. "fr"\.. "lau"].. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \.. "sundag"\.. "m\u00e5ndag"\.. "tysdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "laurdag"].. ::msgcat::mcset nn MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nn MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nn BCE "f.Kr."

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\pl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1263
                                                                          Entropy (8bit):4.459506202908786
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83lUj0ORGgIzdW6RDYKG7FwRc0ypvOvX:43+HMg2W6RDYnFwRc0ydYX
                                                                          MD5:79AB7C13AA3833A1DAEADDB1144CCE55
                                                                          SHA1:C01ABC2F16549CAEC6B081448B2CBA88A680E250
                                                                          SHA-256:61462C325DB0065352D8155307F949869862A86CAC67AD7BB6703F57A7FA2FF3
                                                                          SHA-512:79EB696164FDDD9B121558C2780E54E295FF2DC4D8E87A0DE507B4F2925612721A98FF5010199CB68CF894ACA7A07884E9E02F3DC1E078D241431E3DC884C0A1
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \.. "N"\.. "Pn"\.. "Wt"\.. "\u015ar"\.. "Cz"\.. "Pt"\.. "So"].. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \.. "niedziela"\.. "poniedzia\u0142ek"\.. "wtorek"\.. "\u015broda"\.. "czwartek"\.. "pi\u0105tek"\.. "sobota"].. ::msgcat::mcset pl MONTHS_ABBREV [list \.. "sty"\.. "lut"\.. "mar"\.. "kwi"\.. "maj"\.. "cze"\.. "lip"\.. "sie"\.. "wrz"\.. "pa\u017a"\.. "lis"\.. "gru"\.. ""].. ::msgcat::mcset pl MONTHS_FULL [list \.. "stycze\u0144"\.. "luty"\.. "marzec"\.. "kwiecie\u0144"\.. "maj"\.. "czerwiec"\.. "lipiec"\.. "sierpie\u0144"\.. "wrzesie\u0144"\.. "pa\u017adziernik"\.. "listopad"\..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\pt.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1177
                                                                          Entropy (8bit):4.394980756969744
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83CYkjBc1yHYJt//0/I31YMY47flV7YaqgCyt9Fo8g6Gtvt76svi:43C5LHcNnxJ9Ltg6Gpt76Ki
                                                                          MD5:8F53B3571DD29E12BD33349CFA32F28F
                                                                          SHA1:C125E059B8BFE5FECD482D1A1DA50B8678872BF6
                                                                          SHA-256:6F6EEEDDCF232BDCB952592A144810CED44A1CBB4BCC2C062D5F98D441505380
                                                                          SHA-512:5CD7E7097B720E5399795126A71348816CBA697FD8F14160779E982ADAB00D5994978E2F9445785B0DE62F6F14232278AD1A65BC53730CA58D676B057F0BC406
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Seg"\.. "Ter"\.. "Qua"\.. "Qui"\.. "Sex"\.. "S\u00e1b"].. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Segunda-feira"\.. "Ter\u00e7a-feira"\.. "Quarta-feira"\.. "Quinta-feira"\.. "Sexta-feira"\.. "S\u00e1bado"].. ::msgcat::mcset pt MONTHS_ABBREV [list \.. "Jan"\.. "Fev"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset pt MONTHS_FULL [list \.. "Janeiro"\.. "Fevereiro"\.. "Mar\u00e7o"\.. "Abril"\.. "Maio"\.. "Junho"\.. "Julho"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Dezembro"

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\pt_br.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):4.8608779725401785
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xofm6GPWWjofAW3vLjofAW3v6mjofm6T+3vnFDoAkvn:4EnLB383+NGdg93vk93v6fNK3v9dmn
                                                                          MD5:A2626EA95C2480FEA68906AE6A1F6993
                                                                          SHA1:A0592902337C00FC2E70B1DFB3A42453A86535BB
                                                                          SHA-256:320BE7D5B730091E6FA35F196314737261C8E154577DCF6AC8C2057D44394AD7
                                                                          SHA-512:9801A87D024565676D4F3EAF0702C213E59FC2B6719D8BE95C19C9ED53FC43487F65F5408378B401A2B4C2BD4E2E391C2D848CA87739A6082AB7766EC6B9EFE1
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset pt_BR TIME_FORMAT "%T".. ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T".. ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ro.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1224
                                                                          Entropy (8bit):4.350784108088039
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83coPUMSeZmkTMm41icpK+7ZVoImEcVUCWdvHvWIn:43lPHFmkm1iMVoxEc+CWZPWIn
                                                                          MD5:F6575EC17966320106FF7ABDFB3186E2
                                                                          SHA1:68C6B72D664FDA27450FCE8B5734AB627CE825D7
                                                                          SHA-256:25ED6AC7A353E23B954B98611AE3B7E56BDCF2B0CB0DB358253CFB8BEBBB831C
                                                                          SHA-512:E564543231922A17C898419545BFA65E5E31FE9F005FDD201B735CFDE08E96FB3B98349C2A7959E29CA8F7E6934B0C4C6DE6B5E67209D0DD9A7746DFEBF037B3
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \.. "D"\.. "L"\.. "Ma"\.. "Mi"\.. "J"\.. "V"\.. "S"].. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \.. "duminic\u0103"\.. "luni"\.. "mar\u0163i"\.. "miercuri"\.. "joi"\.. "vineri"\.. "s\u00eemb\u0103t\u0103"].. ::msgcat::mcset ro MONTHS_ABBREV [list \.. "Ian"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mai"\.. "Iun"\.. "Iul"\.. "Aug"\.. "Sep"\.. "Oct"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset ro MONTHS_FULL [list \.. "ianuarie"\.. "februarie"\.. "martie"\.. "aprilie"\.. "mai"\.. "iunie"\.. "iulie"\.. "august"\.. "septembrie"\.. "octombrie"\.. "noiembrie"\.. "decembrie"\.. ""].. ::msgcat:

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ru.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2091
                                                                          Entropy (8bit):4.2886524607041006
                                                                          Encrypted:false
                                                                          SSDEEP:48:43D+pQ7keidQfRQPgQHB81Z/sFIAZSQWQXQrQxJQjQRnQBFQiWftkWt:26pgkeoSnpjA4tMYiJcCMFmVRt
                                                                          MD5:9F1C8DD58550558977821FD500E7C0E0
                                                                          SHA1:EFDD809BC2872A5BE0E353D31BE6D7D72E4B829C
                                                                          SHA-256:BB35BB6F07BAEF72C329EC3E95D6527A2736070EE2FFE5DE227E1FF0332390F8
                                                                          SHA-512:AA3C5C40AE9D342F8287958355C3321CF60566AD3E84E3D18D782FC022A998DA275506A61010A65D2E7D7578F2919C47C63AB0BA63A38800AA48D4B88ACE54D3
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \.. "\u0412\u0441"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \.. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\.. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\.. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"].. ::msgcat::mcset ru MONTHS_ABBREV [list \.. "\u044f\u043d\u0432"\.. "\u0444\u0435\u0432"\.. "\u043c\u0430\u0440"\.. "\u0430\u043f\u0440"\.. "\u043c\u0430\u0439"\.. "\u0438\u044e\u

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ru_ua.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):248
                                                                          Entropy (8bit):4.9420431225061
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoVAgWIZoVY9X3vtfNrsoVA9+3vW6Q9vn:4EnLB383SFWIyaX3vtNl/3vWHNn
                                                                          MD5:DC98D88964650E302BE97FDB3B33326E
                                                                          SHA1:1DDDCC4265D7B980B867FEE674BEF2FD87D823F7
                                                                          SHA-256:13E4E79A0ED82034BADE0CFF8DEF5DE1222F6968108AD710662BDB7DAF36D7E1
                                                                          SHA-512:F3B9D528C529DD520FEDA3C20ED354E521C5B3C29F3317E15B7939CE06A3D67554D34DD6E54FE038585E46C560C604A1FD7E7F84914086B5994D52CE2C9E99CE
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y".. ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\sh.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1212
                                                                          Entropy (8bit):4.359036493565628
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83/YIXo4YY0dD6kMm7fX2NaSIvZdHZgHZ/IxvaGWxvtl9svWTN:43rLTR44/yWltOWB
                                                                          MD5:E297221FA73BD78577B398BC7D061D21
                                                                          SHA1:F2A6B456272F913A9E97C495CEE73AC774C90FA1
                                                                          SHA-256:E65D6E5E837DF0A2DF0DB77BCE45334BBC27EFFF9023C37119E75D49932D9D6C
                                                                          SHA-512:AB9DDAE7CB21193C7753041F0B88CF2D40987E7E604B47816219458D217F084AA4EBF36719E22AAB3FD71A271D9F956ADC353182991903D7ADE8C8F00F6B2F9B
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Uto"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sub"].. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljak"\.. "Utorak"\.. "Sreda"\.. "\u010cetvrtak"\.. "Petak"\.. "Subota"].. ::msgcat::mcset sh MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maj"\.. "Jun"\.. "Jul"\.. "Avg"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset sh MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "Mart"\.. "April"\.. "Maj"\.. "Juni"\.. "Juli"\.. "Avgust"\.. "Septembar"\.. "Oktobar"\.. "Novembar"\.. "Decembar"\.. ""].. ::msgcat::mcset sh BC

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\sk.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1255
                                                                          Entropy (8bit):4.4043119723436135
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83c46o40u3rIsmJIcm93ApLDVb2IcU95WFGEXF3eUCvtz/v3e6:43c3ow3rF93Ap7tEXFREtznp
                                                                          MD5:24DA40901D907D35195CC1B3A675EBC7
                                                                          SHA1:8AF31248F06FADA5CFB0D83A940CFF5CE70E2577
                                                                          SHA-256:976813F6C53C9BEBBF976B0F560FD7FC5E4EC4C574D7E1CD31F9A4056765CB7A
                                                                          SHA-512:A9BC6AAFE9AEEDFD1E483E54A2D27871A09ADD6807D8F90410CD2BB82A91BA9DF435652EC9A7C3AD0A080D7F153CA848BB47DAD3936BA30E4AEFF3C474C433CC
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "Ut"\.. "St"\.. "\u0160t"\.. "Pa"\.. "So"].. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \.. "Nede\u013ee"\.. "Pondelok"\.. "Utorok"\.. "Streda"\.. "\u0160tvrtok"\.. "Piatok"\.. "Sobota"].. ::msgcat::mcset sk MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sk MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "marec"\.. "apr\u00edl"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "august"\.. "september"\.. "okt\u00f3ber"\.. "november"\.. "decem

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\sl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1216
                                                                          Entropy (8bit):4.333705818952628
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83MIXpC9opYuGS/BrIsmZ5hv1yAxyIVjd392WFThENvt0vJoO:43fXYujZrqyApYJtyR
                                                                          MD5:CB76F54CBE0D1AAE8BA956B4C51CBD2A
                                                                          SHA1:C1F78375EDB0BD2504553E33B2024C0C63FDB1B2
                                                                          SHA-256:11A6264676DBED87E4F718075127E32E107854F35F141642454F484984084486
                                                                          SHA-512:69964348FF08DE6EEB5E3DD61057FF0DF5441105EB7BEE7FB7E9AC5E26DCC164E3C7C011CA5CD7BC5B97A7872532331C97CCBC80563F6C5A3548014BFA8BEF16
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Tor"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sob"].. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljek"\.. "Torek"\.. "Sreda"\.. "\u010cetrtek"\.. "Petek"\.. "Sobota"].. ::msgcat::mcset sl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "avg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sl MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marec"\.. "april"\.. "maj"\.. "junij"\.. "julij"\.. "avgust"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset sl B

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\sq.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1321
                                                                          Entropy (8bit):4.408176575111904
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83F7ONQEwXwjjTlVoSEh76W/X+WZQJ4hv+H6v2V:43NwjPEwl4VQ8q
                                                                          MD5:E606F620F03EC0FBDBE6551601299C5F
                                                                          SHA1:0B50AB679E8D90D8E7319BCADAC426E004594D3B
                                                                          SHA-256:1F4EFD78F6B45B65F73F09B2F52FC13C2A7C4138DCB7664804878D197B6EBDF9
                                                                          SHA-512:08AF2B51EB7111E334ADDA3A03F9A8816C104E9742B523EC363FB5131A3DF73D298A8DDCD573D23C23C65CCFD2B8898DF75AE3D4F04BF80744044FB6BAB5EC0A
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \.. "Die"\.. "H\u00ebn"\.. "Mar"\.. "M\u00ebr"\.. "Enj"\.. "Pre"\.. "Sht"].. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \.. "e diel"\.. "e h\u00ebn\u00eb"\.. "e mart\u00eb"\.. "e m\u00ebrkur\u00eb"\.. "e enjte"\.. "e premte"\.. "e shtun\u00eb"].. ::msgcat::mcset sq MONTHS_ABBREV [list \.. "Jan"\.. "Shk"\.. "Mar"\.. "Pri"\.. "Maj"\.. "Qer"\.. "Kor"\.. "Gsh"\.. "Sht"\.. "Tet"\.. "N\u00ebn"\.. "Dhj"\.. ""].. ::msgcat::mcset sq MONTHS_FULL [list \.. "janar"\.. "shkurt"\.. "mars"\.. "prill"\.. "maj"\.. "qershor"\.. "korrik"\.. "gusht"\.. "shtator"\.. "tetor"\.. "n\u00ebntor"\.. "dhjetor"\.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\sr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2087
                                                                          Entropy (8bit):4.307749748884122
                                                                          Encrypted:false
                                                                          SSDEEP:48:43ilQTSBQrQP9QenzMKSFD9NI/QiNQEQrQL1KKYjU5rtAx:2I5EyLMKSFZNIYMzYMKKiqW
                                                                          MD5:BF363AB60B57F6D8FDCDBFD230A28DDF
                                                                          SHA1:6375CBA0A2197DA7E65BEE45C42F02C4F0B9142D
                                                                          SHA-256:FA00A7B22C9941F6C2B893F22B703DCB159CA2F2E4005FD6A74A632AEB786BFA
                                                                          SHA-512:91AD8085EF321A5A0E4D2ED204940CB66E8E230BBEDE59A8A07D1CEED9155FCC6B075A1FCC44AE834C1FEEEB3A59256C4310684C5AC453D4C50DFABD88469814
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0435\u0434"\.. "\u041f\u043e\u043d"\.. "\u0423\u0442\u043e"\.. "\u0421\u0440\u0435"\.. "\u0427\u0435\u0442"\.. "\u041f\u0435\u0442"\.. "\u0421\u0443\u0431"].. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u0459\u0430"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\.. "\u0423\u0442\u043e\u0440\u0430\u043a"\.. "\u0421\u0440\u0435\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\.. "\u041f\u0435\u0442\u0430\u043a"\.. "\u0421\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset sr MONTHS_ABBREV [list \.. "\u0408\u0430\u043d"\.. "\u0424\u0435\u0431"\.. "\u041c\u0430\u0440"\.. "\u0410\u043f\u0440"\.. "\u041c\u0430\u0458"\.. "\u0408\u0443\u043d"\.. "\

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\sv.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1219
                                                                          Entropy (8bit):4.3542418837714285
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83qoLt6yLQoAusrIsmZ5m4AcjTHX92WFfjr4MvBvX:43ZLxQNusrr4Aw3Jkq1X
                                                                          MD5:3B5C3FFA0829768470BDA1B46D882060
                                                                          SHA1:C96799036EC5CCDE799A6B50CD7748908935A2F3
                                                                          SHA-256:483916B51BD7E071E88F9EC36AAF3E08FEA823991532F832DE491C6C40B55A9F
                                                                          SHA-512:684FA249123878AA7F856DF0FD3B0D9F041113CFEA8EEFA47D0E1948DA23694330BF0D62BA896A3891CD559C16CAE9330BF31508F530AC003D2929D5FD9246D8
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \.. "s\u00f6"\.. "m\u00e5"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f6"].. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \.. "s\u00f6ndag"\.. "m\u00e5ndag"\.. "tisdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f6rdag"].. ::msgcat::mcset sv MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sv MONTHS_FULL [list \.. "januari"\.. "februari"\.. "mars"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "augusti"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat:

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\sw.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1040
                                                                          Entropy (8bit):4.108744949579904
                                                                          Encrypted:false
                                                                          SSDEEP:12:4EnLB383A4mScvhkzoR4mtuWckRkoay3UVxMmALfG7IdzVJ633xRCPLMYMvYo76u:4aR83/Shkz1uckO76kMmEf62qOTdMvvn
                                                                          MD5:5774860C8AEECBD48F1502E616158CAB
                                                                          SHA1:DE7059713EA7913A0C79F5386833CE2BCAD2CFD7
                                                                          SHA-256:1DA068C9AA02EF14A2440758C6040D632D96044A20EC501DBB9E40D8592E0E7F
                                                                          SHA-512:91E69222DDF55E9E0E389DB77D7A0F2E082351DC3FB34A1A2C1E350E4187E8BB940F6C2EDE1B8651159C2787AA0BE4D7268F33F7A82CAED03514FCE462530408
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \.. "Jpi"\.. "Jtt"\.. "Jnn"\.. "Jtn"\.. "Alh"\.. "Iju"\.. "Jmo"].. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \.. "Jumapili"\.. "Jumatatu"\.. "Jumanne"\.. "Jumatano"\.. "Alhamisi"\.. "Ijumaa"\.. "Jumamosi"].. ::msgcat::mcset sw MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset sw MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Machi"\.. "Aprili"\.. "Mei"\.. "Juni"\.. "Julai"\.. "Agosti"\.. "Septemba"\.. "Oktoba"\.. "Novemba"\.. "Desemba"\.. ""].. ::msgcat::mcset sw BCE "

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ta.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1874
                                                                          Entropy (8bit):4.080580566597515
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83AI0xnJdnQhmHlHYPKtul+eOPfIxyH5ztUSLu8tptLtrl+eOPfIxyH5ztUSU:43N0dQmHlHYPKtu1HxMtr1Hx/
                                                                          MD5:85288236C3997302EA26D7403BBA2C15
                                                                          SHA1:05AB389CC4DCF17B37BFF6ED1ECD58D6E9850A01
                                                                          SHA-256:AEFDC4255890D5B3FFE5CEE1B457B7D711283C2287ABA644155C10956012F6C1
                                                                          SHA-512:8E389D46606176EE14B8356153095B49C9426B80139B672A620F488891F091D1A272D4FB116775900E4AB4EC84DDDEBD8D6AF81AC672F14F148F2BFC638D2B10
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \.. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\.. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\.. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\.. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\.. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\.. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\.. "\u0b9a\u0ba9\u0bbf"].. ::msgcat::mcset ta MONTHS_ABBREV [list \.. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\.. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\.. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\.. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\.. "\u0bae\u0bc7"\.. "\u0b9c\u0bc2\u0ba9\u0bcd"\.. "\u0b9c\u0bc2\u0bb2\u0bc8"\.. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\.. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\.. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\ta_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):257
                                                                          Entropy (8bit):4.863003494480733
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xosDv+IZosK3v6ry/5osDo+3v+6f6HyFvn:4EnLB383ZDvl5K3v6ry/ZDF3vmSVn
                                                                          MD5:CF078352DA0507C767F04E31D6C14296
                                                                          SHA1:0A9B1255BD85B60D3620AE61370F54748AB7A182
                                                                          SHA-256:4978A193076DE56944236F7F1DCECACFF739536DFB3DBEFC1F7FE2B97A8AEAF4
                                                                          SHA-512:6FFC85B2A8DECB373EC76B1CD1A9459A30E443319F2C8DB9BBE6E115F5EFEEBAC314D4E8BE996EA55EE46466C6F6057A73078F5FDCF1C4CBAF1A270E45BC10C0
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\te.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2149
                                                                          Entropy (8bit):4.097884113767283
                                                                          Encrypted:false
                                                                          SSDEEP:48:43a8mxI9k3JR0UjjFbPcniLHVktjjFbPcniLHVM:2a8v9k3JdbPcIidbPcIG
                                                                          MD5:61E4CB2AAD66285E9113071057F39C35
                                                                          SHA1:A2BD21090859669C4B6A875E077825381B7E2702
                                                                          SHA-256:9E96C7123100234A7018533764502985A208F2EB3314F5B6332D46016725A63F
                                                                          SHA-512:589A2D65508B07B5FDEDA883F71A4B496B25458CA1ECE7C4D4F5DAE82EB683DA82C8E21E57D63A235AB600174C9D362A746B2E27BAA6E3ADE1B7BD9D6000BE27
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \.. "\u0c06\u0c26\u0c3f"\.. "\u0c38\u0c4b\u0c2e"\.. "\u0c2e\u0c02\u0c17\u0c33"\.. "\u0c2c\u0c41\u0c27"\.. "\u0c17\u0c41\u0c30\u0c41"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\.. "\u0c36\u0c28\u0c3f"].. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \.. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"].. ::msgcat::mcset te MONTHS_ABBREV [list \.. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\.. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\.. "\u0c2e\u0c3

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\te_in.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):419
                                                                          Entropy (8bit):5.058324650031252
                                                                          Encrypted:false
                                                                          SSDEEP:12:4EnLB383LjZWsn0sHjoD0savzda3v6ry/ZF3vMSVn:4aR833Z1nnHjoDnavzd8vSCZNvMSV
                                                                          MD5:BCA040A356E7E8CC597EFB9B9065F8E1
                                                                          SHA1:ADAF7EC8C2035BC06E168D3F1BD7F39277E9273F
                                                                          SHA-256:B110FEEDDA21ECCEFA624BEF8E1476E9F221FB253880AC370967AE4D0237CA7A
                                                                          SHA-512:D408ECE8CF89FB23B45420D3CBA7655EEE713498210889A84EE25D3417360705546D97028EAAAA47764B6E9B0A3699669B98C0A53861A38E0DFCB9F3B8A47BEC
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\th.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2359
                                                                          Entropy (8bit):4.382796122808316
                                                                          Encrypted:false
                                                                          SSDEEP:48:439X4QKPQJecQwFA0P9JmDsxQ7KHfWkD2CQM0DnWxFDzCYmdrtVP:29ohCi1028QmHfIC4jW3DmHB
                                                                          MD5:7F61E1EA256D78948189EF07119663CD
                                                                          SHA1:6867E9780049FACE9984B7788B6F362B8D1AD718
                                                                          SHA-256:48BEAF693BF5B6EED15234DB0D375B97E6D576A749E9048420C153E6CAFC0259
                                                                          SHA-512:F3E24E0B41A7D722AC2FA0E429A2DCB1CCB5BAECC9912ADF6AF79C51366EA1AC9F931F0F44F068F3CEE6873516E6223CC5E7616CF523B1DFB9E528DE4D58454A
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \.. "\u0e2d\u0e32."\.. "\u0e08."\.. "\u0e2d."\.. "\u0e1e."\.. "\u0e1e\u0e24."\.. "\u0e28."\.. "\u0e2a."].. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \.. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\.. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"].. ::msgcat::mcset th MONTHS_ABBREV [list \.. "\u0e21.\u0e04."\.. "\u0e01.\u0e1e."\.. "\u0e21\u0e35.\u0e04."\.. "\u0e40\u0e21.\u0e22."\.. "\u0e1e.\u0e04."\.. "\u0e21\u0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\tr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1183
                                                                          Entropy (8bit):4.390397293529625
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR83ZVUflVdq4qTr6dyX59508THHCh5LbQgWiNv9KvWIn:43PXTtbTngLhWiJGWIn
                                                                          MD5:017F0F989BD5DBBF25E7C797CE09C45C
                                                                          SHA1:162922DBD55A31A74410375A36EE7BC50E092BDD
                                                                          SHA-256:4B85B345D6C43F7257C6849A60A492397FD5FD9D82DF3A2252189D7A1ECCBB64
                                                                          SHA-512:73B6CF395753D863330687404E8A584CB08B81A8CC456DCE7BB49C4EA15EA19E45E3CC1E1367E10915DE14AC6258383289BCFEF55AD2768A50889DF390D37EF9
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \.. "Paz"\.. "Pzt"\.. "Sal"\.. "\u00c7ar"\.. "Per"\.. "Cum"\.. "Cmt"].. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \.. "Pazar"\.. "Pazartesi"\.. "Sal\u0131"\.. "\u00c7ar\u015famba"\.. "Per\u015fembe"\.. "Cuma"\.. "Cumartesi"].. ::msgcat::mcset tr MONTHS_ABBREV [list \.. "Oca"\.. "\u015eub"\.. "Mar"\.. "Nis"\.. "May"\.. "Haz"\.. "Tem"\.. "A\u011fu"\.. "Eyl"\.. "Eki"\.. "Kas"\.. "Ara"\.. ""].. ::msgcat::mcset tr MONTHS_FULL [list \.. "Ocak"\.. "\u015eubat"\.. "Mart"\.. "Nisan"\.. "May\u0131s"\.. "Haziran"\.. "Temmuz"\.. "A\u011fustos"\.. "Eyl\u00fcl"\.. "Ekim"\.. "Kas\u0131m"\.. "Aral\u

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\uk.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2165
                                                                          Entropy (8bit):4.289021158621493
                                                                          Encrypted:false
                                                                          SSDEEP:48:436yILgoQjQPxUIkgPDRQnQ0vVQbC1iQwweIgWQDIoZI7QDI3QbI87IVQnIzQ7mh:2AzUe3EhV8CYgrbH7z3fLVTzgn5jyX7p
                                                                          MD5:323BD95809A44B0BADC71AD36E5F095B
                                                                          SHA1:44F6016873CA955D27545C56CCD24BDB06A83C43
                                                                          SHA-256:7093DA7E39CEB6D3F51EB6CF1CCA2D7F3680ED7B8FE4A5F0CECEEF6BEB21AC77
                                                                          SHA-512:DB16E0E2D17CE47673DE781A7171944C14CC550FB8EB0920C05B979E4D067E36DF0B59B8BFA81F82D8FCE1FFDDAAD2755E68BFE5BC0DBB11E8716A4D18BA5F7E
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0432\u0442"\.. "\u0441\u0440"\.. "\u0447\u0442"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0456\u043b\u044f"\.. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\.. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\.. "\u0441\u0435\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440"\.. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset uk MONTHS_ABBREV [list \.. "\u0441\u0456\u0447"\.. "\u043b\u044e\u0442"\.. "\u0431\u0435\u0440"\.. "\u043a\u0432\u0456\u0442"\.. "\u0442\u0440\u0430\u0432"\.. "\u0447\u0435\u0440\u0432"\.. "\u043b

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\vi.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1471
                                                                          Entropy (8bit):4.44729506678271
                                                                          Encrypted:false
                                                                          SSDEEP:24:4aR836DNjYTP55YAUy2tJ9kyzW68IFYHMBSW1K1pvhv1O:43dbYJyC8ySgI1dV1O
                                                                          MD5:C127F54C462917D3B3EEF5F29F612138
                                                                          SHA1:B1D9A67F856D93F98524C6372B352EA0DE1B9CD3
                                                                          SHA-256:E9B7AECD456F1D2288604C982B5DED0DCF71DCA968C0B0EAFF4CA16CC3B73EC2
                                                                          SHA-512:0B0F132F10580751258D37E070338C3B39DF57FDECDB9D0AFA67E90D6766DDCB4D711876E551ED759D177F1B8F4E9E1DD8F7899F7CB57F8039F55EC4C2984E87
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \.. "Th 2"\.. "Th 3"\.. "Th 4"\.. "Th 5"\.. "Th 6"\.. "Th 7"\.. "CN"].. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \.. "Th\u01b0\u0301 hai"\.. "Th\u01b0\u0301 ba"\.. "Th\u01b0\u0301 t\u01b0"\.. "Th\u01b0\u0301 n\u0103m"\.. "Th\u01b0\u0301 s\u00e1u"\.. "Th\u01b0\u0301 ba\u0309y"\.. "Chu\u0309 nh\u00e2\u0323t"].. ::msgcat::mcset vi MONTHS_ABBREV [list \.. "Thg 1"\.. "Thg 2"\.. "Thg 3"\.. "Thg 4"\.. "Thg 5"\.. "Thg 6"\.. "Thg 7"\.. "Thg 8"\.. "Thg 9"\.. "Thg 10"\.. "Thg 11"\.. "Thg 12"\.. ""].. ::msgcat::mcset vi MONTHS_FULL [list \.. "Th\u00e1ng m\u00f4\u0323t"\.. "Th\u00e1ng hai"\.. "Th\u00e1ng ba"\.. "Th\u00e1ng t\u01b0"\.. "Th\u00e

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\zh.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3385
                                                                          Entropy (8bit):4.5164095151631125
                                                                          Encrypted:false
                                                                          SSDEEP:48:43qrY2BBT7uxDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyke2gdr:2yPTKdo
                                                                          MD5:2F356DE14D48B1091DEAA32D20C38D96
                                                                          SHA1:4AB78D47A73290000955A7C1DFDF7106093F69FD
                                                                          SHA-256:EB247F5184A59414D3DF7E3ECA51F5998C248CFB27D2C02E62A7A30AB35197A7
                                                                          SHA-512:602410830018B455C68AE2EBDD83BA561CF59DA5898E00C80CE7EF619912E591EB38B4C8FE8D9B1F024E7105B0C4D2D326FC855F31E79C1B954429B947DFFBB1
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh MONTHS_ABBREV [list \.. "\u4e00\u6708"\.. "\u4e8c\u6708"\.. "\u4e09\u6708"\.. "\u56db\u6708"\.. "\u4e94\u6708"\.. "\u516d\u6708"\.. "\u4e03\u6708"\.. "\u516b\u6708"\.. "\u4e5d\u6708"\.. "\u5341\u6708"\.. "\u5341\u4e00\u6708"\.. "\u5341\u4e8c\u6708"\.. ""].. ::msgcat::m

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\zh_cn.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):319
                                                                          Entropy (8bit):5.167825099880243
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoX5YBoHJ+3vtfNrsoHJ+3v6MYBoXa+3vYq9vn:4EnLB383U5YMJ+3vtN3J+3v6LcL3vYqN
                                                                          MD5:9FCDC2E80E13984D434E3CC91E1ED14C
                                                                          SHA1:710D9EE2A71021F4AB609886138EED43C1380ACD
                                                                          SHA-256:4C8A855700FEFE8EE21B08030FF4159D8011AE50353F063229C42DE6292475CF
                                                                          SHA-512:D899A1F58DF1051BB2C2C4AC859C52A2D19B1593C37022A29439B37A8057ADC3941F3564E2E1D9CEB72AE123A4E12E24C3736343AA3A5EC8749AB5AEBBF65085
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e".. ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2".. ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\zh_hk.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):780
                                                                          Entropy (8bit):4.716025632367214
                                                                          Encrypted:false
                                                                          SSDEEP:12:4EnLB383HmSBBHZovDh4ToC4qU3WwVW3v6P3v3WwSn:4aR83Hxo14u3Ww+viv3WwS
                                                                          MD5:CFDA7B6463305FA15DBBA72D725A1876
                                                                          SHA1:2BF885073FBAF4A38B7AFDA76CA391F195A5A362
                                                                          SHA-256:7E1C5BD9EC1A17BB851B0DCABD0DFA9FF9D64B89603D9D3FBEAAC609172346AE
                                                                          SHA-512:55F974C706933ECE0575A33C381D9B370B8A408C5C5514C805EC04C8B0CA5BAFAA47267DA98E1805B478A9589FFB7549D79002B2A7AF387049011D78DD7605B6
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u4e00"\.. "\u4e8c"\.. "\u4e09"\.. "\u56db"\.. "\u4e94"\.. "\u516d"].. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"\.. ""].. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5".. ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S".. ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\zh_sg.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):347
                                                                          Entropy (8bit):5.062880051437783
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoOpEoPpFocMohX3v6Zwoh+3v6fxvn:4EnLB383J53v6O3vCn
                                                                          MD5:3218F8E6BEDD534277DE0849C423158E
                                                                          SHA1:10C006446A10406A5644C4033665E877EBF72AF7
                                                                          SHA-256:500546B3211D454659D845B4AB9AEF226125100DF40407C49530DE17CDD4363F
                                                                          SHA-512:3142893DA85BA8F83A5B6851B313B5F5FF80D2B989C1AE015665EE70373249B44EFB4FF7C621F1D8F37AC6019EF5E8D6D21C76C48998C3D9072F9C5060AA8813
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_SG AM "\u4e0a\u5348".. ::msgcat::mcset zh_SG PM "\u4e2d\u5348".. ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y".. ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\msgs\zh_tw.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):354
                                                                          Entropy (8bit):5.124064818715749
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSyEtJLl73oo6d3/xoAykaRULH/XRxy/5oAyjZRULHi5oAyU/G0OMoAyxW3v6ZQ:4EnLB38315xDOiKRRW3v6F3v8A2n
                                                                          MD5:9010E34791B5DDB7F1E0AD4DA6BD4623
                                                                          SHA1:418F7374BABEF27FEC8E00D3A32F535084593AB9
                                                                          SHA-256:DBA0584B8E1925B439F06E0BF0965E97AFB7EB39E70E0E4C9B70769EBC5F996C
                                                                          SHA-512:D3AB698B725E84DAB06E472C41FF2EB55D63885D22B4598C596800BAC83A02A44CB524524F267D090952AF7E0031F47720786ACF9E354EF672CF9EEFB7DB3BD4
                                                                          Malicious:false
                                                                          Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d".. ::msgcat::mcset zh_TW CE "\u6c11\u570b".. ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e".. ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z"..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\opt0.4\optparse.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):33777
                                                                          Entropy (8bit):4.60013086740989
                                                                          Encrypted:false
                                                                          SSDEEP:768:4D0xrpIuhenN4kA0G6sRcl5AdtsPLKiF64aJQ2L:HpnhsS9C5Adqua5aJvL
                                                                          MD5:4ECD97188BFED58A15FE22EC566FA6A3
                                                                          SHA1:6E4E91096298F1A0AE6CD4241F167C8B4F661EE5
                                                                          SHA-256:67A157F1873D606B53DC4D894BD8E71F6B1A0DD66177B9513BD039B348B40349
                                                                          SHA-512:1D5067BBB13DAB001168EEB41EBFA2D13BACB0F43A8067CC93923E8F4D062AA387DA23D7D98D6A2AE77D7C849A6026F2343102CBE03690C2CEA0890222339475
                                                                          Malicious:false
                                                                          Preview:# optparse.tcl --..#..# (private) Option parsing package..# Primarily used internally by the safe:: code...#..#.WARNING: This code will go away in a future release..#.of Tcl. It is NOT supported and you should not rely..#.on it. If your code does rely on this package you..#.may directly incorporate this code into your application.....package require Tcl 8.5-..# When this version number changes, update the pkgIndex.tcl file..# and the install directory in the Makefiles...package provide opt 0.4.8....namespace eval ::tcl {.... # Exported APIs.. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \.. OptProc OptProcArgGiven OptParse \... Lempty Lget \.. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \.. SetMax SetMin......################# Example of use / 'user documentation' ###################.... proc OptCreateTestProc {} {.....# Defines ::tcl::OptParseTest as a test proc with parsed arguments...# (can't be d

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\opt0.4\pkgIndex.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):620
                                                                          Entropy (8bit):4.702477618616754
                                                                          Encrypted:false
                                                                          SSDEEP:12:jHxIRu9zhjJS42wbGlTULuUAZb3KykszLYIGbyAkXaqrQ+pBb6:biRUJS42wbGlTUcZ+yk2LY0XaqrB4
                                                                          MD5:07532085501876DCC6882567E014944C
                                                                          SHA1:6BC7A122429373EB8F039B413AD81C408A96CB80
                                                                          SHA-256:6A4ABD2C519A745325C26FB23BE7BBF95252D653A24806EB37FD4AA6A6479AFE
                                                                          SHA-512:0D604E862F3A1A19833EAD99AAF15A9F142178029AB64C71D193CEE4901A0196C1EEDDC2BCE715B7FA958AC45C194E63C77A71E4BE4F9AEDFD5B44CF2A726E76
                                                                          Malicious:false
                                                                          Preview:# Tcl package index file, version 1.1..# This file is generated by the "pkg_mkIndex -direct" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....if {![package vsatisfies [package provide Tcl] 8.5-]} {return}..package ifneeded opt 0.4.8 [list source [file join $dir optparse.tcl]]..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\package.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):23995
                                                                          Entropy (8bit):4.884828325514459
                                                                          Encrypted:false
                                                                          SSDEEP:384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
                                                                          MD5:DDB0AB9842B64114138A8C83C4322027
                                                                          SHA1:ECCACDC2CCD86A452B21F3CF0933FD41125DE790
                                                                          SHA-256:F46AB61CDEBE3AA45FA7E61A48930D64A0D0E7E94D04D6BF244F48C36CAFE948
                                                                          SHA-512:C0CF718258B4D59675C088551060B34CE2BC8638958722583AC2313DC354223BFEF793B02F1316E522A14C7BA9BED219531D505DE94DC3C417FC99D216A01463
                                                                          Malicious:false
                                                                          Preview:# package.tcl --..#..# utility procs formerly in init.tcl which can be loaded on demand..# for package management...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval tcl::Pkg {}....# ::tcl::Pkg::CompareExtension --..#..# Used internally by pkg_mkIndex to compare the extension of a file to a given..# extension. On Windows, it uses a case-insensitive comparison because the..# file system can be file insensitive...#..# Arguments:..# fileName.name of a file whose extension is compared..# ext..(optional) The extension to compare against; you must..#..provide the starting dot...#..Defaults to [info sharedlibextension]..#..# Results:..# Returns 1 if the extension matches, 0 otherwise....proc tcl::Pkg::CompareExtension {fileName {ext {}}} {.. global tcl_platfor

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\parray.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):844
                                                                          Entropy (8bit):4.883013702569192
                                                                          Encrypted:false
                                                                          SSDEEP:12:TF7S2n2wn2SNHaeYF9xcwrmXhbs1GUiSYX3EtSK78ex4VIpynEw88/McUBbPgnz:TF7Hn2wnlk2KwyZSM4SkV/3UB7Cz
                                                                          MD5:577787C2F4F5956BA70F83012B980AE5
                                                                          SHA1:040B2469F796F3FDFCD1E1DD2EB1C5B799EDEF62
                                                                          SHA-256:E269029C8263E3CBC1920C3604ECDCF15EDCCB208A0D68F9EB42B73954D620C0
                                                                          SHA-512:C2940F6F3D77412EFC537B8AB67352F519DFFA95739FCC17BF1817335AFD9E5BFE91ABE98CBA99E278CB4923D4E6D431ED9D72282745203C0F7D73193F550238
                                                                          Malicious:false
                                                                          Preview:# parray:..# Print the contents of a global array on stdout...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....proc parray {a {pattern *}} {.. upvar 1 $a array.. if {![array exists array]} {...return -code error "\"$a\" isn't an array".. }.. set maxl 0.. set names [lsort [array names array $pattern]].. foreach name $names {...if {[string length $name] > $maxl} {... set maxl [string length $name]...}.. }.. set maxl [expr {$maxl + [string length $a] + 2}].. foreach name $names {...set nameString [format %s(%s) $a $name]...puts stdout [format "%-*s = %s" $maxl $nameString $array($name)].. }..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\safe.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):42223
                                                                          Entropy (8bit):4.822635446297551
                                                                          Encrypted:false
                                                                          SSDEEP:768:H/Jo8y7AyARYhZfc3njlVdRIp4xOtoYx4WneNiBq5vIhfwEaqadlUCJ2Pbb1P6:H/c7AmhZmnjvdRIG924WneNiBq5+fwEc
                                                                          MD5:B8C1561D471CFBF4111C706411D59883
                                                                          SHA1:71483EAEEF377EE9AF90BEC44F70C7B12C5BC720
                                                                          SHA-256:C21DCE3AB31893118BBED01E559070F1D3541877FEE331BD45F5BF4300ED9654
                                                                          SHA-512:465065A938C71AF4588B3331B51A62DD57F57492EB1CB6C0F52B9FD0A2FE7A54B1E995AA56E4A41D7A99EAFF665C1E23E3B240FB3F9840AB242C21B1DBFFFF45
                                                                          Malicious:false
                                                                          Preview:# safe.tcl --..#..# This file provide a safe loading/sourcing mechanism for safe interpreters...# It implements a virtual path mechanism to hide the real pathnames from the..# child. It runs in a parent interpreter and sets up data structure and..# aliases that will be invoked when used from a child interpreter...#..# See the safe.n man page for details...#..# Copyright (c) 1996-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....#..# The implementation is based on namespaces. These naming conventions are..# followed:..# Private procs starts with uppercase...# Public procs are exported and starts with lowercase..#....# Needed utilities package..package require opt 0.4.8....# Create the safe namespace..namespace eval ::safe {.. # Exported API:.. namespace export interpCreate interpInit interpConfigure interpDelete \...interpAddToAccessPath interpFindInAccessPath setL

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tclIndex

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5617
                                                                          Entropy (8bit):4.747404679682368
                                                                          Encrypted:false
                                                                          SSDEEP:96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
                                                                          MD5:C62FB22F4C9A3EFF286C18421397AAF4
                                                                          SHA1:4A49B8768CFF68F2EFFAF21264343B7C632A51B2
                                                                          SHA-256:DDF7E42DEF37888AD0A564AA4F8CA95F4EEC942CEBEBFCA851D35515104D5C89
                                                                          SHA-512:558D401CB6AF8CE3641AF55CAEBC9C5005AB843EE84F60C6D55AFBBC7F7129DA9C58C2F55C887C3159107546FA6BC13FFC4CCA63EA8841D7160B8AA99161A185
                                                                          Malicious:false
                                                                          Preview:# Tcl autoload index file, version 2.0..# -*- tcl -*-..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(auto_reset) [list source [file join $dir auto.tcl]]..set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.t

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tm.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):12204
                                                                          Entropy (8bit):4.763796758810551
                                                                          Encrypted:false
                                                                          SSDEEP:192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
                                                                          MD5:215262A286E7F0A14F22DB1AA7875F05
                                                                          SHA1:66B942BA6D3120EF8D5840FCDEB06242A47491FF
                                                                          SHA-256:4B7ED9FD2363D6876092DB3F720CBDDF97E72B86B519403539BA96E1C815ED8F
                                                                          SHA-512:6ECD745D7DA9D826240C0AB59023C703C94B158AE48C1410FAA961A8EDB512976A4F15AE8DEF099B58719ADF0D2A9C37E6F29F54D39C1AB7EE81FA333A60F39B
                                                                          Malicious:false
                                                                          Preview:# -*- tcl -*-..#..# Searching for Tcl Modules. Defines a procedure, declares it as the primary..# command for finding packages, however also uses the former 'package unknown'..# command as a fallback...#..# Locates all possible packages in a directory via a less restricted glob. The..# targeted directory is derived from the name of the requested package, i.e...# the TM scan will look only at directories which can contain the requested..# package. It will register all packages it found in the directory so that..# future requests have a higher chance of being fulfilled by the ifneeded..# database without having to come to us again...#..# We do not remember where we have been and simply rescan targeted directories..# when invoked again. The reasoning is this:..#..# - The only way we get back to the same directory is if someone is trying to..# [package require] something that wasn't there on the first scan...#..# Either..# 1) It is there now: If we rescan, you get it; if not you don

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Abidjan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):147
                                                                          Entropy (8bit):4.995501022397479
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2DcsBdNMXGm2OHnFvpsYoHsdSalHFLwy:SlSWB9eg/2DBpDm2OHnFvmYoH1alHOy
                                                                          MD5:FF8B5540631A6EE93507338C4E7AA49D
                                                                          SHA1:817B261A1B6B92AA498EC286349964EA10FB5A84
                                                                          SHA-256:7213997BB9CF9D384A7002B8C8EFEF25C01ABA6083D9835A16D583D5DCEE40A0
                                                                          SHA-512:8D78AC4868ED0013EDA536C0E82E0E91398772AA18C637AEFE22F24B142FCDA55A4CB853B2282951E907C9E2F62BD3F831A5CF995F52898F5225D16889943A9C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Abidjan) {.. {-9223372036854775808 -968 0 LMT}.. {-1830383032 0 0 GMT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Accra

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.832432925672155
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dc9XfBQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DUGDBS
                                                                          MD5:52FDFD3DB98475FBBB620D0D5565C5CC
                                                                          SHA1:C7750452859663605272553DBEE0B6C134E1517C
                                                                          SHA-256:6040827AFED8CEF45F252FBD7E3E862C0B5E9D06C1C98C58BAD61DFE67BD57CC
                                                                          SHA-512:2FF9D96D81279148A86BE208FEEACCBCB8B4224D093D6C092ECD1C4EA2186589CCF947027D3A726600C703611B4CFEE029AA14ED3E8593C477B427C4F342CF27
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Accra) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Addis_Ababa

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.817170256300069
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DczqIVDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DnaDkO
                                                                          MD5:30CDD4D37E9DD60FBF6D754C9343F364
                                                                          SHA1:56F896C21068764B7B8F884F374B18913CA3D9CA
                                                                          SHA-256:E11FD8AD8572B684333810CFDC23B92E1ACF619875866985E288D92F8277D07F
                                                                          SHA-512:78FC8043CCE25713404E70996229E5EA8238BF5C0F59029064EDA5494E2D4F54398931F3D855E30C82B2C53B789C40EE4CBF09D0F98C2BA6734595D4AA75017A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Algiers

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1080
                                                                          Entropy (8bit):4.187497782275587
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862D7nmdHh5Cv6/lHY8SOSuvvzXipFSgSO5vW5aKmvbsF6VWsXN87QBWcAFy:5veSvKlHYXNujXipFSjKRKXiWsXCGWJy
                                                                          MD5:E8D3DF11CE0E7575485573FA07D955D5
                                                                          SHA1:3B2C00C85B6C0BFAA1C676C970D6DF1B4BDC3D4A
                                                                          SHA-256:E6874647561CE1C5FD1F650C9B167F77AC5B24FD2026046399A9043CF998E5C4
                                                                          SHA-512:E2968BE847622CF243C0E498436FD21BDC2E1DF0FD8D694F2C70569D17CE896CDE4968BB8ABDEF9F687439E4EA2D955AE87D6C15E81F881EE1413416A90765D4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Algiers) {.. {-9223372036854775808 732 0 LMT}.. {-2486592732 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1531443600 0 0 WET}.. {-956365200 3600 1 WEST}.. {-950486400 0 0 WET}.. {-942012000 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796262400 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766630800 3600 0 CET}.. {-733280400 0 0 WET}.. {-439430400 3600 0 CET}.. {-212029200 0 0 WET}.. {41468400 3600 1 WEST}.. {54774000 0 0 WET}.. {231724800 3600 1 WEST}.. {246240000 3600 0 CET}.. {259545600 7200 1 CEST}.. {275274000 3600 0 CET}.. {309740400 0 0 WET}.. {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Asmara

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.801054282631739
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjEUEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DGs+DR
                                                                          MD5:A543BDEB3771017421FB75231F0004F2
                                                                          SHA1:D682C58C27562FF3ABAB8EDE8EB6EA754DA7C02E
                                                                          SHA-256:064EB7F9A1FA05A317C6BDCA6B102BC1560D980758F9E4DDB010C9E7DC068ECB
                                                                          SHA-512:44848D60EDC79AF784A819714C0D9F62DCCB6329B47F25D74AB8C174BF9EC3F783C66FEB27F588A93FABA9BECAF076F453D6D797CE4F28461F7AE69440EA54C7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Asmera

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.806258322241929
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjAWDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2D8DkOn
                                                                          MD5:1B5E386E7A2F10D9385DE4C5683EBB85
                                                                          SHA1:FECBA599C37493D2E0AEE8E21BAB40BF8E8DC82A
                                                                          SHA-256:76939852A98EA7BF156D0AC18B434CC610DAF5232322C0FBB066CD52C5B72AF7
                                                                          SHA-512:B36FABFCDB2187A3A4A211C8E033D96C91E3C4D47907D284E10786555562C82231566033EAB4753EF1E48DF1233CFC8C6C0FB3CA50748BE0B2554A972A88FBA0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Bamako

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.883634030944169
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcxAQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwNDBS
                                                                          MD5:6B9BB5B37C41AA727E31BF03483DC1CA
                                                                          SHA1:CB3BBA37B063EA4A54CD15C6E30C14D8CA30D3C0
                                                                          SHA-256:F6D1BA22115A6565B6D6ABEB578F001DDB41E673C422C8EA70D0DF77B24115F6
                                                                          SHA-512:23DB3E298FDEB165FD85D99E03C00835B584984B814AF7F54A9CDD4A9F93E16B0C58342D319129F46CF8EC36F93DE5EA51B492CA4CABDAB75D84709BC6C26119
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Bangui

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):178
                                                                          Entropy (8bit):4.882974805254803
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcx2m/2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dw/2D4yn
                                                                          MD5:92FF9E5835C0C80F358BFE69120660A0
                                                                          SHA1:724758B43BD79DD8A29B02BE6910D492924F8280
                                                                          SHA-256:5047A507D22B68C9349EB6A48C41C80DB4C69F98F99C6574059DEA87178E36C0
                                                                          SHA-512:6FCB709DB4AC19191FECE1E8BAC55E77F265B5AF89F7A3565F06BFAF0BEE12E3EAF2F52CA09C68D75C358C25A31867505CE8AD75D7386DCD15F4BE1CE61272CD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Bangui) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Banjul

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.888193386512119
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcx79FHp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dw7J4c
                                                                          MD5:46E5703CF284E44E15E5872DF075FCBC
                                                                          SHA1:EA4BFA6D568DFA877F72302ADA21ECC2840D9FD5
                                                                          SHA-256:77E610A02CCECE3045B09D07A9BE6100F5AA9C3C2AEB543535C9AE941194F4E4
                                                                          SHA-512:1454467FE63E97DFA4DE66E359F68B2D80C92CDE59FC15A4BE513629FFD154D2281EADF3FC78F7AFDDF5A5896195F3A69E66697A659BBB1A0EAFD3E1DA6565EC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Bissau

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):176
                                                                          Entropy (8bit):4.847843768169462
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2Dc5iDMXGm2OHGVkeoHsdSawwF6hSVPVFwy:SlSWB9eg/2D4uDm2OHCkeoH1awwFMmMy
                                                                          MD5:7E710C939B9CC0C1AC1ECF4239B543C5
                                                                          SHA1:429CC87086FB22727815ED05AC6472333FF06013
                                                                          SHA-256:2A870E534DE67713C27F2F3B9BF26FA7498C240CF633988CE76DBDAC5B69214D
                                                                          SHA-512:70D9365C31C43A95211FC20E9290B24D356FFEFA935B8829CE32831026A196DECDD12226097F6DA3B4B919E137AA0181714680CDBB72B00C130A87E3A4735004
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Bissau) {.. {-9223372036854775808 -3740 0 LMT}.. {-1830380400 -3600 0 -01}.. {157770000 0 0 GMT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Blantyre

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.904342145830274
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc8ycXp75h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAmp1hs
                                                                          MD5:7AD3749D7047855CB9B9EC9696015402
                                                                          SHA1:F792359AD9EEC2ABD98DAFA6661C1E57BAB89EBE
                                                                          SHA-256:8F700409B8EEE33ACE5F050414971FFEE0270949842E58E9299BB5CD6CCF34DE
                                                                          SHA-512:681C1B318746C587DEBA6E109D1D5A99D1F3E28FE46C24F36B69D533D884FDDC6EA35BB31A475575D683B73BF129FED761523EC9285F2FF1E4CACA2C54C046C5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Brazzaville

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.901235831565769
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DciE0TMJZp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D4qGp4D1
                                                                          MD5:7028268EE88250AC40547A3FDBBFC67C
                                                                          SHA1:5006D499CD1D1CB93EB3DA0EC279F76B7123DAA6
                                                                          SHA-256:596DB2D64CDD6250642CB65514D5BCB52F3E3EA83F50D8915D9D4FDEA008F440
                                                                          SHA-512:D623C69FE8A6050E77FB819C2F5FAEE35D5034182B1D30A409C17208155501656133E774E402875537335F8201E4734A0B5D327712CBF623AC330F1014D9025B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Bujumbura

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.947752840781864
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DclbDcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkbDEi
                                                                          MD5:0EBC2D8F0BD1A32C21070F9397EAC9E2
                                                                          SHA1:95AAA97427265635784E8AC624CA863DB9F1475D
                                                                          SHA-256:9A15867255B43A954CA60DA11660F157553AAB6A15C50ACD49D182276E0CF4CC
                                                                          SHA-512:4CD2E14F84C58E955742637A51D99DB9493972671A2B5D801EBD9D901D4903654E374C59BF010C70071D33FA17788358F78004201A787CCA2AD714D670393488
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Cairo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3852
                                                                          Entropy (8bit):3.7766651198444507
                                                                          Encrypted:false
                                                                          SSDEEP:48:58ybRwEa40MF4pt0/jaGYbaJF0a3T07ITB85oWXmSGmuyTVuV0apRQnL0KD3rZza:fLg1GbJFp3gHRQVy7DPUUQkiHMo
                                                                          MD5:9DCDB3DD41DA13D81EB8E1CAF56964DA
                                                                          SHA1:F95EE7B1EF464F2640EC4AE29F3C18B5BF2B2905
                                                                          SHA-256:8698B0A53D858AEA7C495EDF759EF0E6C63F7E07A256599393DEC7B7A7413734
                                                                          SHA-512:BA5898ABEE541BC72C9DEDD77BABB18024C7AEA0274FA3F809748FCBFF770BFAD902BF70680DDE989F7D3592E5398C100D0E0EA388D4200911ED7DE089535D6D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Cairo) {.. {-9223372036854775808 7509 0 LMT}.. {-2185409109 7200 0 EET}.. {-929844000 10800 1 EEST}.. {-923108400 7200 0 EET}.. {-906170400 10800 1 EEST}.. {-892868400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-857790000 7200 0 EET}.. {-844308000 10800 1 EEST}.. {-825822000 7200 0 EET}.. {-812685600 10800 1 EEST}.. {-794199600 7200 0 EET}.. {-779853600 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165801600 7200 0 EET}.. {-147402000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Casablanca

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5532
                                                                          Entropy (8bit):3.535398586134154
                                                                          Encrypted:false
                                                                          SSDEEP:96:zE+CJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:7MZSszBrlKcJC9k
                                                                          MD5:18183122D242E0B69A80BC02BC0328DF
                                                                          SHA1:C9976ABC0663EB29A2FEAAFDF6746C05A264B67C
                                                                          SHA-256:8776EEDFDFEE09C4C833593127CEFAC9C33E2487AB9BF4BF8C73E5E11B4E5613
                                                                          SHA-512:9611A6EF9C5B55FAB752C1EC7E464B8AF60AE32383CE9BA72F35168ABB68A45DB0654A9099CBDC123F5F6E2B6DB7C8FBF56A8DDB813824187AD1090971F12219
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Casablanca) {.. {-9223372036854775808 -1820 0 LMT}.. {-1773012580 0 0 +00}.. {-956361600 3600 1 +00}.. {-950490000 0 0 +00}.. {-942019200 3600 1 +00}.. {-761187600 0 0 +00}.. {-617241600 3600 1 +00}.. {-605149200 0 0 +00}.. {-81432000 3600 1 +00}.. {-71110800 0 0 +00}.. {141264000 3600 1 +00}.. {147222000 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {448243200 3600 0 +01}.. {504918000 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {13731

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Ceuta

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7536
                                                                          Entropy (8bit):3.8315604186920704
                                                                          Encrypted:false
                                                                          SSDEEP:96:TzLdXKy9f4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:TdayR41sFpM5vwA6Efv03TBZLl
                                                                          MD5:30155093248C4F7E45EF7C0132D2B2AB
                                                                          SHA1:FAD100CC49F0CB0910BDE39B43295A47512E1BE6
                                                                          SHA-256:8827F7311EDE69A9679BDF2B7418DBF350A2FC8F973E8B1E1E4390D4D5C6D2E8
                                                                          SHA-512:469A24AF0C2A4A40CB2488C3E21BB9BBDE057F876EACA08A31FC6F22845063D917A0A4AE96680401E45792DE534EE3A305F137A93C4DF879B4602510D881270E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ceuta) {.. {-9223372036854775808 -1276 0 LMT}.. {-2177452800 0 0 WET}.. {-1630112400 3600 1 WEST}.. {-1616810400 0 0 WET}.. {-1451692800 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1293840000 0 0 WET}.. {-94694400 0 0 WET}.. {-81432000 3600 1 WEST}.. {-71110800 0 0 WET}.. {141264000 3600 1 WEST}.. {147222000 0 0 WET}.. {199756800 3600 1 WEST}.. {207702000 0 0 WET}.. {231292800 3600 1 WEST}.. {244249200 0 0 WET}.. {265507200 3600 1 WEST}.. {271033200 0 0 WET}.. {448243200 3600 0 CET}.. {504918000 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Conakry

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.88110192592456
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcmMM1+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DCM1+c
                                                                          MD5:8CDD2EEB7E0EC816F3EC051350FEBF13
                                                                          SHA1:37F3A149B4A01DFA2EAB42A28C810BE66AAB7C52
                                                                          SHA-256:3176C99FC45337CBCE0CD516DE4B02B8BAA47D00E84F698122A2ADD57797984E
                                                                          SHA-512:5A90B6DB45EDAD7734D596FB81FD1959A433F57E71D2212E1DCBD6A12F3FD1FE747FA363C4C787A4D3023F542553C1E2C9CF4F61E28F1BB13042E4AFE3D0FF31
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Dakar

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.856992353568779
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXXMFBx/2DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DKXEBn
                                                                          MD5:946D3B52F915445DBB8EE8BF67F4EFAB
                                                                          SHA1:18345968B95E886CA72634D49F2B38F9B29BA629
                                                                          SHA-256:D50F9732757B284BAC75526F2CFA585DF7F6974160827AFB0FF66124C7CFD361
                                                                          SHA-512:00B531D1352CF35045EE25C777C7FEA17294E9861E68CE2DE0D9884C05EBDEA84D5F4F0E8B5605721295E25C259979446B7DB76525A633C7D2FA35B38962CF43
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Dar_es_Salaam

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):191
                                                                          Entropy (8bit):4.8447607449193075
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2Dc8bEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DJbVDR
                                                                          MD5:7A819572758BC60F4085DF28F1DD1C01
                                                                          SHA1:0A5BA34EBFBA5A8E8B896713BA527781FC90FF01
                                                                          SHA-256:AB69948637416219A3D458777990FA4568BEBC89388884BBF129C0E1370A560B
                                                                          SHA-512:C03E785D1E85292056BB0BDD8DF8326C5DFEB6070AB1C071E1032D14EA69C9DEBC57B2CC7852E35D31652187126CCF0009A6A5C32F9DBB75D56C705535DF05CC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Djibouti

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.829357904445218
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcRHKQ1BQDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DOrkDR
                                                                          MD5:7981499F9430DC1636C9F834273E0B91
                                                                          SHA1:1D63F8578420D56E4A5D9D0881FBEC015421E416
                                                                          SHA-256:E7F7560CCD65D53C446ADAE7128A74D37E17DD0B907A2F2FD85322FB8707B497
                                                                          SHA-512:3C3F7D78E9A0DE6E2950E1C305EA2DBC986754AE9FB10AC410685F30C39EC235F6F221393099C012E62EE5A7B4F1BED67C96B7B81E90BBA064BA9FE685FE4050
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Douala

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):178
                                                                          Entropy (8bit):4.850101792457859
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcnKe2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dml2D4yn
                                                                          MD5:44881E75AC32FA95FF6143066EF01B90
                                                                          SHA1:A221619B4CDE8BE6A181E1F3869EAB665F2E98B8
                                                                          SHA-256:FCF2DAD148F4D2951320EA99730C56D5EB43D505F37416BE4BAD265CE2902706
                                                                          SHA-512:4FA67A5F84758366189F0FC4A7FA6C820BA083E1C56EA95D25D21A367F25F76261B7EB5631DFFEB20E095CFD64E770338773F76BD50D4CF6AE29AD3EDFCEC408
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Douala) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\El_Aaiun

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5235
                                                                          Entropy (8bit):3.541189246992611
                                                                          Encrypted:false
                                                                          SSDEEP:96:+eCJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:+eqZSszBrlKcJC9k
                                                                          MD5:956F5B51FA8BA2E954A0E59AAC8F3276
                                                                          SHA1:AE35A8502E57EA6EE173E3B42509E4CAC73DA091
                                                                          SHA-256:5FB102A95B3C004AAB8371840B1A04AC352F48FF9E9EAFDEAAF21960B0F3CAA6
                                                                          SHA-512:19E7F2574E2B62DF68CC24737F6B94864B3D64B2472BC7D78E6AB5142A1DC1AB3B3700AB802129CB16AED4A4FED29E2B8A5593EE327ADF496255FE2FEF6A7023
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/El_Aaiun) {.. {-9223372036854775808 -3168 0 LMT}.. {-1136070432 -3600 0 -01}.. {198291600 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {1373162400 0 0 +00}.. {1376100000 3600 1 +00}.. {1382839200 0 0 +00}.. {1396144800 3600 1 +00}.. {1403920800 0 0 +00}.. {1406944800 3600 1 +00}.. {1414288800 0 0 +00}.. {1427594400 3600 1 +00}.. {1434247200 0 0 +00}.. {1437271200 3600 1 +00}.. {1445738400 0 0 +00}.. {1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Freetown

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.866631090752554
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcu5sp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dk4DBS
                                                                          MD5:6C115220CF951FC2EE3C299F86935B6D
                                                                          SHA1:A1CAB8C710BF20553AF45343118C1726CFE922B7
                                                                          SHA-256:BC53A4D489F48F14C594C4B0E52079B34E043A5751BBC7DF254A560352243575
                                                                          SHA-512:E87A4FD145B645DF034182CAD7F9D2BE5B2D9F3A17B6A9B6C84A0B3E846D92EC4C69DF2E85129B7A1AFBC0CCAAC8E3B1D47EB09F0900A82B908E9F6BF63B9736
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Gaborone

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.899477454245453
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcHK0o/4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAV+4Dt
                                                                          MD5:07222D8ED83CDC456B4D5D84C4BDE320
                                                                          SHA1:2C657F461FA3F48D56C791AFE4AB7D2EAF45AF60
                                                                          SHA-256:653AF88955C4418D973E2F8681A99552EB7BE95BCA64C736072F488462F7B373
                                                                          SHA-512:3016D0636F401BD88BCD460F6A61782E7E8A2C32CE4ECB904C711DF414038A5818F0CA3D7FC671C5ABCE70647FC674A2EF9081C5289EBFD184B44885902E007A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Harare

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):181
                                                                          Entropy (8bit):4.884642061266759
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc0B5h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2Dlfh4Dt
                                                                          MD5:8666DABE8D196ACD94A9691C592FAF4E
                                                                          SHA1:9F7EE009DCEAACA79C6EAA6FC73015D595467919
                                                                          SHA-256:06B82C524585192E0E8FC69DCC1CF86183A8C5EF404645DC413FCF3F8C16B0AB
                                                                          SHA-512:AAA32FD1B01BFECDD0D1C9C1DF1163374DAFE094C75720EA4095C34F7EAE7DCB594D1A7F6A2A90FB43FF01020F7AEB48E92496E0EE2D039AF23076CD369DD2A7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Harare) $TZData(:Africa/Maputo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Johannesburg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):309
                                                                          Entropy (8bit):4.695542624694403
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2DWbzDm2OHePoHvmmXsd//HF2d7d6VcF2d6KsYov:MB862DW7mdHePCvmmcZvF0cVcF/KsFv
                                                                          MD5:F0E153FC9B978E30742ABC025CA45E02
                                                                          SHA1:73D96F3188190DAC2453E6F18A1C683CECB9CDE3
                                                                          SHA-256:5EEF6475E1312051037FCAE3354E32DC0910BE7A5116B71F8CCBE1CCA08D3F1C
                                                                          SHA-512:E66F4B5FF18BAAD53AFB1ED36A0827115C793075A61F794F26F32BC9F6799DF816A1F817BEB0C0BC938F89E6F5BFBE1AB4F504F1AF518764103FB287746552C7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Johannesburg) {.. {-9223372036854775808 6720 0 LMT}.. {-2458173120 5400 0 SAST}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {-829526400 10800 1 SAST}.. {-813805200 7200 0 SAST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Juba

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1127
                                                                          Entropy (8bit):4.027824722230131
                                                                          Encrypted:false
                                                                          SSDEEP:24:5mesdOkMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8M5:5YMV04MSHMzNxMbwM0JXMfCsMzaMq0QJ
                                                                          MD5:32EC0589260D9D4BCC85FE91E6F04D00
                                                                          SHA1:BAA269852C4AC6B89EA7941E7A75A007E0CF9EDF
                                                                          SHA-256:F2646E15488ABF2E960759CEFE5705416E71DA71BB8407B26196244FD1A3394F
                                                                          SHA-512:4F485453BE1D186ADBE0908852475C63C57BA498091C222EFFB9A5FEA2DB7F55E1BB2DBDBF6AC0F24CC67D47549FA3F5257655B5449B1BCF1FB5CDB27B03D501
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Juba) {.. {-9223372036854775808 7588 0 LMT}.. {-1230775588 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Kampala

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.837466713772859
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcJEl2DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DIEl2V
                                                                          MD5:E929ED1BC316C71AABE7E625BD562FB1
                                                                          SHA1:C20C172518C02D93327F4BBBC5D410BFFEF5039D
                                                                          SHA-256:8EA3028CE2B025F0C457DC8F7601279CA5AF565A88B9FE80208F9F1030F2B0D0
                                                                          SHA-512:B2FBCF06EACCF18DE97AF1D6BC57D9638E0A36DBF17044FF97F6B9E5089CF9E13E1304F304495324C0ACC1128A7D2D494E7C1FDB95DB0855FCE54F7028096C50
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Khartoum

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1131
                                                                          Entropy (8bit):4.0421745451318385
                                                                          Encrypted:false
                                                                          SSDEEP:24:5xe9dSXMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8MM:5hMV04MSHMzNxMbwM0JXMfCsMzaMq0Qc
                                                                          MD5:2BD3850DDBE2F05BF6F24F3AEFF7516C
                                                                          SHA1:22B0DBB54E071F30D51A8654CF103F99537F74CD
                                                                          SHA-256:F475DB8A857A46B310B12C21D6A9BC6CA9FF2960DA429A9D57FA375F9439E13B
                                                                          SHA-512:1CF82FC07348C697F26625673DA7E3D734358B3FBE69D8E2132CAC0D9F00C7E8CDC353676CD9BAC4CBB9E26CF6638CEAE41DF559E7445D9C453409D7115FFC6C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Khartoum) {.. {-9223372036854775808 7808 0 LMT}.. {-1230775808 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Kigali

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):181
                                                                          Entropy (8bit):4.910322325134086
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcCJRx+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DRX+DEi
                                                                          MD5:3017253E1C6ACCA8D470A014E4BB321D
                                                                          SHA1:671B7AC04580B56E2C34F88D123E8296947DDD7E
                                                                          SHA-256:73FEB807006897B4B485CB82394867444E890265EFE960EC66D6C0E325DA9372
                                                                          SHA-512:2498C380D761A16C183D78BC1BB18B1D2A1BFCB9C703D86A3FC04CCCE43D88C8D4BC3C47CC31639B78A5FE9C8A7445E9DBB52062E2F3B737DA1E7D0FF70F140A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Kigali) $TZData(:Africa/Maputo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Kinshasa

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.866127364448228
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcqQFeDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DdD4yn
                                                                          MD5:41209A335A99803239A854575190C5ED
                                                                          SHA1:E6EA627C25513B9DDE053F9A24D509AA317C30A1
                                                                          SHA-256:611375C4901AD6C4844C2BB7D02FB17F34996F49E642546A6784D6F0B28530CC
                                                                          SHA-512:DF2C0B131F35F54DF5EBF7F8459F98DBABEB6F081247BA95B5D7B41146E2A2EF9BC6B1D909DE57A1223D9C258AB197D9668ED2E111A365C86BABDAA7DF551FB6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Lagos

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):235
                                                                          Entropy (8bit):4.7936510664790815
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2D4JDm2OHWQvvoHvBsp9boFvoHzIX7uRe6vF9:MB862DymdHWQCvqpmVCzIq
                                                                          MD5:EC08046589E85D999A597252FF5368B7
                                                                          SHA1:126E3DE158E1E7AF4737D0AB5B51C0F92F416DC7
                                                                          SHA-256:DCC9F52F539A67DFD7ABAFDE072ACDAE2B67754C559C8A5FE61979F5A286A066
                                                                          SHA-512:84B9AB18BC343C8B8934F5FDD2E2EB413925B04D6F5394AA8337B7B55E6487FB071A83A69BD4D0FA40F7F31EBC57B9908729674542CEA3083D700FCD02D77633
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Lagos) {.. {-9223372036854775808 815 0 LMT}.. {-2035584815 0 0 GMT}.. {-1940889600 815 0 LMT}.. {-1767226415 1800 0 +0030}.. {-1588465800 3600 0 WAT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Libreville

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.865878143076229
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcr7bp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dgfp4D4y
                                                                          MD5:35D8A58EE21E603C6FC4FB896AE6B3D0
                                                                          SHA1:F1D0A939D761F3F0954F045814CF5339A5597036
                                                                          SHA-256:AB3E797548C7663CF9ABA7FE163635FF7CAB9E6CB61FA1644C0F7B4B5CCE8B99
                                                                          SHA-512:97717961987F6B6832C24A7833150CDFE7E82BBEB32DFDB84D2500442AAD9263F8BD4E879591E913D56E9A1991C389EF730211853647A889F358AE3FA37C0185
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Libreville) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Lome

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.862780607964543
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcih4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DNh4D4
                                                                          MD5:EA21ABBF8B11953916A1C509B8A1B427
                                                                          SHA1:35ADC230C57B001BE8A99A3D2E34B609A60A1162
                                                                          SHA-256:EACA9124F17E5B11F27D11FA6141D19EB3AC23E155E155B73467BDAA3BC99AA7
                                                                          SHA-512:A7972D4F1C5FB988CA04B39E2CDD580F51383BA9D7A66C478275C11A07B8D7A6EFF53A3E1929B0D89F10BCC39D22F285DB2601ED60DB4647C65465643F70C137
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Lome) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Luanda

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):178
                                                                          Entropy (8bit):4.856982839546061
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DccLtBQDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DXQD4yn
                                                                          MD5:40CD47F6DCF51EBEFEF42489F1716257
                                                                          SHA1:DF245192A1899A72DE01A57F6969AC060E841734
                                                                          SHA-256:4C2FD1E44DFAAF0C0DD2EB56B84B538F1E2D84B301AB2CFB8EE7759783501444
                                                                          SHA-512:D39BEB0EEF344B1A44F7D6A806A1D5B956D7D402648EE0C67C4BA46493236840AF975D89A91B2D33B8AA7D6DC9A051E66718DCDBC1C83B0E964215C2E32ED923
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Luanda) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Lubumbashi

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.940313336280723
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcfpT0DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2D8pT0Dt
                                                                          MD5:71A5DE1276902DB1542840318F9B1AF3
                                                                          SHA1:AC3825BF343482E0E4D9D6FAA6FCA4D1A125433B
                                                                          SHA-256:24384EEC359FD24D181AAEF3C017E3C345490A8D352B29D19B1B143A29A811C2
                                                                          SHA-512:2984EB42A79B8B32BB93DFE71F1C4C0CABFDC9B0A199971347BB3473463FA07FDB5D20227D288BF8653B1BDE347E1297459BBB4C3C34AF7A5434FBF945683577
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Lusaka

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):181
                                                                          Entropy (8bit):4.905174746463853
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcOf+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkDEi
                                                                          MD5:1D7FDB388535CC59742CA0F1AEE27FBD
                                                                          SHA1:A99FF2CAC47FD333429C22B271E190D979EEC024
                                                                          SHA-256:B00801A7279741434D9C2D7EC7322DD93B85EA4F5C9976AB3A43F0AB142E1553
                                                                          SHA-512:0174D3C6F9116C36C62AD1EB58203EE7DFE8C37F618B8449D5E45AD6290CF8334F28798877D7A563A12EE533026244D6A49BCCF29B5D7FCB5BCC91481D0DDDE2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Malabo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):178
                                                                          Entropy (8bit):4.857096806490649
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcn2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D42D4yn
                                                                          MD5:1CA9B3E7BCD5BC1CC881453D16B09389
                                                                          SHA1:1B1964B314E72847D71A42C147CF2BF331B44461
                                                                          SHA-256:35D56EFFE9E7E60F17B32BD30486E566B635F0AE7A8948D77395B8E6332E26F1
                                                                          SHA-512:9E08D57B7824F5B076D159D9A5106E51450DF24729C36F485B9B68E8F47E8DFC50F9BEC3F11E0AE6579A8E372A5C0F0DA18A2E797CF2115519D1B4E5B64413DD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Malabo) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Maputo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):149
                                                                          Entropy (8bit):4.952872531197478
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2DcfKiMXGm2OHoVoHvdSF2I:SlSWB9eg/2DEZDm2OHoVoHvdI
                                                                          MD5:CD429B6891CBF603A93F9A9733E2391B
                                                                          SHA1:C6833B83B6D1694AC632018A27915E6F97F708AE
                                                                          SHA-256:FE6B6A4BE1B61F7F909A3F6137530DFE6D1754499A4D9B0D1CE4952FFF0AE62D
                                                                          SHA-512:6E57B70B71515998AD617954F9DDAE19968B20946542201153DAB47FBE63790D42F41AE29148ECBCE6D12812879BCF0A4EC881507B62CDB2675AB20267220BF9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Maputo) {.. {-9223372036854775808 7820 0 LMT}.. {-2109291020 7200 0 CAT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Maseru

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):199
                                                                          Entropy (8bit):4.964472328419063
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DZQs+DWb4n:MByMaHw7NH/t2DZiDWU
                                                                          MD5:88C8FF2B480648EDADBD0FB93F754275
                                                                          SHA1:BED7A784C378909914CEB0D303DFE6D05FD576B7
                                                                          SHA-256:1D80FD86CB733D57D88ECD404E702F750B233ED0CCBFBFFFEED1AAD3B7F1CB04
                                                                          SHA-512:CB7F831CF099E85B948AE57FCE9D91C7EAAD39753AF82C56EC15B65830EB4115A71BBC83A71A2AC947CAB24DEDDB557E02FAA5A3264546AE6E60607DF6BD2FA3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Mbabane

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):200
                                                                          Entropy (8bit):4.957246428185456
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DzjEHp4DWb4n:MByMaHw7NH/t2DzjEJ4DWU
                                                                          MD5:CA7255B86425BA706D214924856B6818
                                                                          SHA1:E9BE6CF871BB1786E842953D41392299952EC9AC
                                                                          SHA-256:547197C09C1987350AE5720A4EEC7E8D8F4B9F4A0559726E225E13C707F7C564
                                                                          SHA-512:23F9AD0F926A0945A17BBC3DCFF9A3D7EE68EC9423EA78985F5FFC60CC61641B57871F9AA703B5FB9BE842DCD4693D0641F9EDED702240873F58D24CD4D60C32
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Mogadishu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):187
                                                                          Entropy (8bit):4.877126792757121
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcBEBXCEeDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DFSVDR
                                                                          MD5:5C2E2B5189E0E816D5BD7AFC8B49A35E
                                                                          SHA1:4E43A1ED51399528636D6442B1DDFFD820911407
                                                                          SHA-256:25E221BE49DEC5547A74AEB91B0041859C59BC866987272A447AB2343D1CC30C
                                                                          SHA-512:B74735CFAB692756BAADFB1A51A8CC0C986F981D8E7E7A8182370A9017E67439875F0115820A349AFB3BE2FA581A721440968EF817471DD2C5E1286E53B2FE99
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Monrovia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):208
                                                                          Entropy (8bit):4.8660011420394955
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2D3NPDm2OHrFGxYoHvlHIg5pTwdPsy:MB862D3NbmdHhmYCvdIg5GPsy
                                                                          MD5:1B3C94B5098E454981C73C1F2AF80164
                                                                          SHA1:1EBA9E2DBEA70BB1AE5EB13739518AB5A62D2130
                                                                          SHA-256:2BF0D90610211651127402680519B29AB50B15D344263D0C1A22EDEBE5E01E27
                                                                          SHA-512:DA4A0BCE7C6750BD7D3BA76B6301B9390723BE0C001C39BE453D80BD87020C2253A75629F68F83C19410D2A75FAF5223A435299CD4AA53DE545EC7C5B5AA54B7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Monrovia) {.. {-9223372036854775808 -2588 0 LMT}.. {-2776979812 -2588 0 MMT}.. {-1604359012 -2670 0 MMT}.. {63593070 0 0 GMT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Nairobi

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):277
                                                                          Entropy (8bit):4.655052651600954
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2Dk1Dm2OHsvT5oH99VCV22ufPnVCkVBKBQn9q:MB862DGmdHsvVCjkifvdH9q
                                                                          MD5:B640661FB37BB74FAB172DBDF1B433E1
                                                                          SHA1:0236A5B53443A4A18B8B9D6AA7732620BE9A6553
                                                                          SHA-256:BD8E9765174431C0D403249D3E881C949C83966E9F8162552DA88AE53132467B
                                                                          SHA-512:53DCC6DF7C3E0B00A6D98A8DCC4988C8CFD6B53CC89E6F8D32DA41CB532A62D9C6A823675C5039F5639CE0D423F6D571F46F5B93FFC7EFFB4EDFFBF89D46AA12
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Nairobi) {.. {-9223372036854775808 8836 0 LMT}.. {-1946168836 9000 0 +0230}.. {-1309746600 10800 0 EAT}.. {-1261969200 9000 0 +0230}.. {-1041388200 9900 0 +0245}.. {-865305900 10800 0 EAT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Ndjamena

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):208
                                                                          Entropy (8bit):4.856754881865487
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2DjUfDm2OHNseoH1axCXFHzaSmkFWTvF9:MB862DjULmdHPC1XNzaS3yz
                                                                          MD5:EDB548348E590C8CFE04ED172D96B86C
                                                                          SHA1:AD3B631FB03819772164402E202AFA781687F597
                                                                          SHA-256:9ADA5F5AFB25E823E1F0E8AD2489AAA1C09F01356634A9403670D7AB21CA2E2C
                                                                          SHA-512:17E396A9BE497077B774AD1108CC8760ED35FC92F65FFF070F9ACD3C4FB67A335C1C57DF1CCB1570DE14B708EFCA0063990A969E30759C9A47731DA45ED25EFE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ndjamena) {.. {-9223372036854775808 3612 0 LMT}.. {-1830387612 3600 0 WAT}.. {308703600 7200 1 WAST}.. {321314400 3600 0 WAT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Niamey

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):178
                                                                          Entropy (8bit):4.871519187180041
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcdhA9Ff2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dsh2f2D1
                                                                          MD5:0134039CD1666E983A9B6E43ABD6AF59
                                                                          SHA1:A2A99345390F4D17C892CEADE58C604257686764
                                                                          SHA-256:B517120AD8DB3F21EAB4E44A78001EE856EB4EA35852C54CCA96D38887DEBCFA
                                                                          SHA-512:E5911ADD3D776D87ACFC986C4D2564E3ED9AB12C67F23391ED35FF2A31AD8314B873E31DB8DA4D5E0DAEA12BE34110A8F0C27C9C6126977BAD51C6AD5CDFA39B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Niamey) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Nouakchott

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.909962899502589
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcboGb+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dqbb+c
                                                                          MD5:550E482599C2F4280F2C258019BB2547
                                                                          SHA1:A39045BEF313094CEDC100A7D695AE51BC9E498D
                                                                          SHA-256:64CAF2BF9D45095DF97F419714D5617CF6300ACDB544B621DCE1D594AA9B910C
                                                                          SHA-512:4FD29C5B4C0D2BDE69C437E9BF4F08A11E1DAAA689B69F28F3551F550BDCCDD055E4C1A241EDB2FA48B18825AFF792F4860F55983E106EA8224F1D87ED4F7546
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Ouagadougou

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.920023025906233
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXCZDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2D1DBS
                                                                          MD5:6CFC4E938E50C9B591F8CC42A14FA82A
                                                                          SHA1:FCE14A5CA62C9005C76D27B849A238E76C834F8A
                                                                          SHA-256:03B9C1FE350B5E9F6F333F9519FA394DCC562308D9388A903AF3D3FECEBDC762
                                                                          SHA-512:98F22F1D23A9930276A2D306A1473E64DC43547A16CFD01226E4F030A26A3CC4FDED77F790583CC5C078FC6DFCCE81C16A50879AE46A0D3A6F1FA98373F413C7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Porto-Novo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.893842293207225
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcyTKM0DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DQD4yn
                                                                          MD5:6D979FCD225D5431C7391AE568C6409F
                                                                          SHA1:6C9DCD222061CC00FD386773C6BB2861F3429A60
                                                                          SHA-256:8FB8692DB9281AE2B087D704168BFD47D3D0901781FEF65BFD62FCB213BA6B50
                                                                          SHA-512:32AFA6AF6BFC3D42CA636DD2B96906048EF1ADFBB135BB7E7B77C444FED99FDABB84FBBADF56EC63828FFA7B3371191FF1311822B1C75241EBD9CF602467088E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Sao_Tome

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):234
                                                                          Entropy (8bit):4.818597723513168
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2DXDm2OHH5oHvzdoH1aNbbFHRMy:MB862DTmdHH5CvzdC16bZRMy
                                                                          MD5:28A5967C797F4B38FB63F823D6F07168
                                                                          SHA1:17872E91683B884191D2E4C777FB79DCE6D73EE7
                                                                          SHA-256:BA1D60DF2B41320F92A123A714E17E576C89383526B96E0541A464C3FBA415B7
                                                                          SHA-512:B335E3D3268631F3A71F4BAD59740F3A5222344E8223C201B8FE885BAA7F1A550FA7778E498D6DC2111F41053856F50B21413AECCE84B80833EC8176F2A1009C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Sao_Tome) {.. {-9223372036854775808 1616 0 LMT}.. {-2713912016 -2205 0 LMT}.. {-1830384000 0 0 GMT}.. {1514768400 3600 0 WAT}.. {1546304400 0 0 GMT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Timbuktu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.905303708777235
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcHdDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwdDBS
                                                                          MD5:F2D7F7BC4EA3629EC7F0E45300A0CFD2
                                                                          SHA1:E7594D378C5DCFEB1E87E13AC79A026260D2E630
                                                                          SHA-256:9D8009ACAB019B32B1E87AB10E0AC3765ABCABE8066318DA8CA4905D41562F72
                                                                          SHA-512:795E58172907020C85CF0B10BBA35842D5F92872CCB3382DFDC787BAA504C79927FA23BC3104AD63541A95C44CA80977E8247846DE918A0B00963B970F4823D2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Tripoli

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):954
                                                                          Entropy (8bit):4.151253074491018
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862DrmdHrCDWR+f7Zn9ueRSmNvlTtuyI/ZBv8dq8Jw4VFZBZYEuAENSfp8kSYx:5veuDkWx3NdT18kbjjAkxTx
                                                                          MD5:2DF9B050D82B06EB89DA908C31C1F1C9
                                                                          SHA1:CB294E12560A98D5CEA3BA7004B5519B6C22BAAC
                                                                          SHA-256:B447B6B1C351E77F22A2D77C0437F2BBB7D8BDFDFDC3D6285E0D260519CC7110
                                                                          SHA-512:BBE281D551E9F8DA7B6BB08D809177615410A11E4B1184ABD220EA8B1F355B2BBC090C6BAAF7E07FD61286891388ECD4026D4433C4E4B6A8D201F8D95E174532
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tripoli) {.. {-9223372036854775808 3164 0 LMT}.. {-1577926364 3600 0 CET}.. {-574902000 7200 1 CEST}.. {-512175600 7200 1 CEST}.. {-449888400 7200 1 CEST}.. {-347158800 7200 0 EET}.. {378684000 3600 0 CET}.. {386463600 7200 1 CEST}.. {402271200 3600 0 CET}.. {417999600 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {465429600 3600 0 CET}.. {481590000 7200 1 CEST}.. {496965600 3600 0 CET}.. {512953200 7200 1 CEST}.. {528674400 3600 0 CET}.. {544230000 7200 1 CEST}.. {560037600 3600 0 CET}.. {575852400 7200 1 CEST}.. {591660000 3600 0 CET}.. {607388400 7200 1 CEST}.. {623196000 3600 0 CET}.. {641775600 7200 0 EET}.. {844034400 3600 0 CET}.. {860108400 7200 1 CEST}.. {875919600 7200 0 EET}.. {1352505600 3600 0 CET}.. {1364515200 7200 1 CEST}.. {1382662800 7200 0 EET}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Tunis

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1111
                                                                          Entropy (8bit):4.150944563639585
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862DHmdHjCvbB/lxRjntMVyoKCyFWeey0XSe/OSyHaCgmvLOcSFQSFeSTC6ZPJ:5LemvbplxRhbv+yuh2tIee6kvcw9Cy
                                                                          MD5:0C99335A41D33AA8BC1EDA0CB4CDCBF5
                                                                          SHA1:5CABC28D318FA5B8307429EA571FFF91EB8E1252
                                                                          SHA-256:0760D1028E733888E43E7F1E057217DC2B52786029FCEC67B27EB69CC6A54938
                                                                          SHA-512:C8FE685ACA46FD4836F3AABC15833F294E5EBED123A487D04E74A8C5668BDFAFB96D2326760452A6E5A1B9CC25AC6C3918D8C10A7F8EF737456640E3000BBA2F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tunis) {.. {-9223372036854775808 2444 0 LMT}.. {-2797202444 561 0 PMT}.. {-1855958961 3600 0 CET}.. {-969242400 7200 1 CEST}.. {-950493600 3600 0 CET}.. {-941940000 7200 1 CEST}.. {-891136800 3600 0 CET}.. {-877827600 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-842918400 3600 0 CET}.. {-842223600 7200 1 CEST}.. {-828230400 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796269600 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766634400 3600 0 CET}.. {231202800 7200 1 CEST}.. {243903600 3600 0 CET}.. {262825200 7200 1 CEST}.. {276044400 3600 0 CET}.. {581122800 7200 1 CEST}.. {591145200 3600 0 CET}.. {606870000 7200 1 CEST}.. {622594800 3600 0 CET}.. {641516400 7200 1 CEST}.. {654649200 3600 0 CET}.. {1114902000 7200 1 CEST}.. {1128038400 3600 0 CET}.. {1143334800 7200 1 CEST}.. {1162083600 3600 0 CET}.. {11747

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Africa\Windhoek

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1649
                                                                          Entropy (8bit):3.9974091170263066
                                                                          Encrypted:false
                                                                          SSDEEP:48:5t+Lmcz0iMHHWMbnHoMcHiM0H+MCySHr/MDHqMafHO8MwHJMHHOMHSHWMHHXM5Hs:OLjQDI6jZ2WFcv
                                                                          MD5:4846FB13467BA93EB134D88228D7F534
                                                                          SHA1:477FC6144B7DF365606A2E44EF1430F8DF6FB841
                                                                          SHA-256:DFC3D1FC182B315B31D999BC103C264BD205EB16F971C8636003A71170D7BD7C
                                                                          SHA-512:A719F5083F66CE44FE047880A10B2ED04B66E01C7F0F7DADAE2FFB95172308F091D669BCFED5A236D2A0F80A4A1D78DA7A778DDE3FAECB40170ECDA705573769
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Windhoek) {.. {-9223372036854775808 4104 0 LMT}.. {-2458170504 5400 0 +0130}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {637970400 7200 0 CAT}.. {764200800 3600 1 WAT}.. {778640400 7200 0 CAT}.. {796780800 3600 1 WAT}.. {810090000 7200 0 CAT}.. {828835200 3600 1 WAT}.. {841539600 7200 0 CAT}.. {860284800 3600 1 WAT}.. {873594000 7200 0 CAT}.. {891734400 3600 1 WAT}.. {905043600 7200 0 CAT}.. {923184000 3600 1 WAT}.. {936493200 7200 0 CAT}.. {954633600 3600 1 WAT}.. {967942800 7200 0 CAT}.. {986083200 3600 1 WAT}.. {999392400 7200 0 CAT}.. {1018137600 3600 1 WAT}.. {1030842000 7200 0 CAT}.. {1049587200 3600 1 WAT}.. {1062896400 7200 0 CAT}.. {1081036800 3600 1 WAT}.. {1094346000 7200 0 CAT}.. {1112486400 3600 1 WAT}.. {1125795600 7200 0 CAT}.. {1143936000 3600 1 WAT}.. {1157245200 7200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Adak

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8447
                                                                          Entropy (8bit):3.867931581740766
                                                                          Encrypted:false
                                                                          SSDEEP:96:6hvOs5vveFaHU6lgqN/zNMkixlrxYTMcmo1LWF59:6hvOstgqN/zNMkArxiZmf
                                                                          MD5:DF52E726B33FA47EB115C1233614E101
                                                                          SHA1:26B0E49022FCB929F0160617F9C9D2DBEDC63610
                                                                          SHA-256:77231D179260C08690A70AEE6C2517E4B621ED4794D9AEEA7040539F4FF05111
                                                                          SHA-512:48AAF25419E07B06E076B0E19F9A0C27EB257556E62FD8F7B2AA963A817823DD89D33AB6AFEAAC2EF2230361D76776355E19CC2BBBB4D19536F823A347AC8AA4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Adak) {.. {-9223372036854775808 44002 0 LMT}.. {-3225223727 -42398 0 LMT}.. {-2188944802 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Anchorage

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8685
                                                                          Entropy (8bit):3.9620252256806845
                                                                          Encrypted:false
                                                                          SSDEEP:96:esKLO6KLC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:etLhN9DiaJCUbPI+D/iMpCIBSuk
                                                                          MD5:BFEACEA04AAA8A69A9AC71CF86BCC15C
                                                                          SHA1:1693971B8AAA35021BA34799FB1B9FADC3DA0294
                                                                          SHA-256:DE7FBE2B3ED780C6B82099E1E249DD41F4452A3ADB9DD807B1D0EC06049C2302
                                                                          SHA-512:E94112A2A5F268C03C58CE3BB4C243B2B9B0FC17CB27FDD58BCD2CCC8D377B805C87A552AE7DE1C5698C5F2C4B0FCAB00A3420B1DAD944C1A2F7A47CE7118F78
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Anchorage) {.. {-9223372036854775808 50424 0 LMT}.. {-3225223727 -35976 0 LMT}.. {-2188951224 -36000 0 AST}.. {-883576800 -36000 0 AST}.. {-880200000 -32400 1 AWT}.. {-769395600 -32400 1 APT}.. {-765378000 -36000 0 AST}.. {-86882400 -36000 0 AHST}.. {-31500000 -36000 0 AHST}.. {-21470400 -32400 1 AHDT}.. {-5749200 -36000 0 AHST}.. {9979200 -32400 1 AHDT}.. {25700400 -36000 0 AHST}.. {41428800 -32400 1 AHDT}.. {57754800 -36000 0 AHST}.. {73483200 -32400 1 AHDT}.. {89204400 -36000 0 AHST}.. {104932800 -32400 1 AHDT}.. {120654000 -36000 0 AHST}.. {126705600 -32400 1 AHDT}.. {152103600 -36000 0 AHST}.. {162388800 -32400 1 AHDT}.. {183553200 -36000 0 AHST}.. {199281600 -32400 1 AHDT}.. {215607600 -36000 0 AHST}.. {230731200 -32400 1 AHDT}.. {247057200 -36000 0 AHST}.. {262785600 -32400 1 AHDT}.. {278506800 -36000 0 AHST}.. {294235200 -3

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Anguilla

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):202
                                                                          Entropy (8bit):4.908728298285591
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290/8J5290ppv:MByMYbpwt290/8m90b
                                                                          MD5:1C3CE9F156ABECEAA794E8F1F3A7ADDB
                                                                          SHA1:6F84D0A424FD2DE85E3420EA320A186B277B0295
                                                                          SHA-256:F38610019C0A2C18AC71F5AA108B9647D9B5C01DCB55211AFB8312308C41FE70
                                                                          SHA-512:CA2DA6F9551E4DBF775D7D059F6F3399E0C4F2A428699726CD2A1B0BB17CCF5CDEEF645EE1759A2A349F3F29E0343600B89CE1F4659CF5D2B58280A381C018AD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Anguilla) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Antigua

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):201
                                                                          Entropy (8bit):4.898881450964165
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290//MFe90ppv:MByMYbpwt290//V90b
                                                                          MD5:DB16FFE76D625DEC731AB6320F5EF9BF
                                                                          SHA1:D286994E03E4F82C08DE094B436FA098648AFADE
                                                                          SHA-256:561E58E11DC5A86CAE04B5CB40F43EFCFF9ABC0C841FAC094619E9C5E0B403F8
                                                                          SHA-512:8842B616205378AF78B0B2FC3F6517385845DE30FFD477A21ACFA0060D161FB6462A3C266DCFD54F101729446B8E1B2ECF463C9CF2E6CE227B2628A19AF365F9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Antigua) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Araguaina

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1782
                                                                          Entropy (8bit):3.733307964154526
                                                                          Encrypted:false
                                                                          SSDEEP:48:5KChlvEw6kSSx5H4a8tf3fkuozd23t8VZDG8+GCRRRd:QIlvEwJSSxdF8tfMuozdCt8VZy8+GCRB
                                                                          MD5:9B01680A362EA7B462DC236F6A35E14C
                                                                          SHA1:456A5E771F6B749BFDB2BFD59836A6A930499881
                                                                          SHA-256:B1327CBEC20A21E3FF873E28A2EDFA271EE3A5C01933779300EABD6B185DA010
                                                                          SHA-512:E6C2F5C489BEA31B0AAC3CB1DB750AC2B665DAC0AC82C1CE6756E768305300297BA5E3B32EDEB9E1715452F02223E47674C4F2B1844920F664623C9F34309240
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Araguaina) {.. {-9223372036854775808 -11568 0 LMT}.. {-1767214032 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Buenos_Aires

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2048
                                                                          Entropy (8bit):3.7664759014118188
                                                                          Encrypted:false
                                                                          SSDEEP:48:5p9uuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0wi:jIu3pfe92jCs/VOHv2kdeRtnxafwwfF0
                                                                          MD5:2B9A1EDE5110B46E24F4726664EA1E3F
                                                                          SHA1:939D1A7A50544F34B318ACDB52BC6930FE453F6D
                                                                          SHA-256:BC86AC89121EC4AA302F6259CCC97EFFD7022DC6CEE3B291C57DA72B6EA0C558
                                                                          SHA-512:C204740DACBCECF2CC5CF4FEB687E86B9150512623203C999D6F4EB5FB246D07681A35C28D8445F6A50F49940C321E0AA5E51FE5A73B8ED076F29CEB5B4D4CA2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Buenos_Aires) {.. {-9223372036854775808 -14028 0 LMT}.. {-2372097972 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Catamarca

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2077
                                                                          Entropy (8bit):3.742645155048276
                                                                          Encrypted:false
                                                                          SSDEEP:48:5/nuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0NC:Vuu3pfe92jCs/VOHv2kdeRtnxafww3mP
                                                                          MD5:3D2AF5714DFC392ED4BC976784D5A58A
                                                                          SHA1:9252DE40B6EF872E1D2F7CDD53DDD21145E93C5C
                                                                          SHA-256:A516BB0937977EF949D47B3C8675E30F1CA6C34F8BD298DCF6EBB943580D5317
                                                                          SHA-512:8D5FFDB5B578B8EA0291D3A21BDDE25F8301CB16B11AE794FFBA8DCFFE46F6AC5EC03D93E511061B132D84E69E5FAF1BB212837EB8A5A4B4BE517F783837E615
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Catamarca) {.. {-9223372036854775808 -15788 0 LMT}.. {-2372096212 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522740

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\ComodRivadavia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):242
                                                                          Entropy (8bit):4.72138001874583
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/290/MquQ90/MMXAy:MByMY/MYp/MrRt290/MquQ90/MK
                                                                          MD5:8A609667DE461CEDC1127BE38B161459
                                                                          SHA1:557D2D55DEA38D1CD1103E183F89C65F4016662B
                                                                          SHA-256:8CCD6FC77D55582938F1912B1BA66035882D1BFC18A797C631E5E89ABFBF570B
                                                                          SHA-512:DBAFDA069DB5FDBCBA11050AC91A733C1712BD6395939CFFFC5EAA78BD0B70B4AF2D9FB8954C6841CCF3AC5F8EDCF08E604D3F2CF67F1CBEA5EB6D3C4DC7F2FA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Cordoba

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2043
                                                                          Entropy (8bit):3.7481312409221594
                                                                          Encrypted:false
                                                                          SSDEEP:48:5lxQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0n:/xBu3pfe92jCs/VOHv2kdeRtnxafww3j
                                                                          MD5:8C1D665A25E61CE462C2AC57687763BF
                                                                          SHA1:B5BBC26CF6A24BD5BEA42AC485D62C789B80905F
                                                                          SHA-256:FA75E274240A341C6BFE3539CFDC114D125AEAEA3161D3C2409347CF8046042A
                                                                          SHA-512:A89A7A92C025B87DA4CDFE99BF70CD0E64690D7BFE827DCBFBF0E91B188003FA26487E72B6B950D3BFC9C854B890E5936F414BBEAAD5F3F0673AC5EFE273CDF4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Cordoba) {.. {-9223372036854775808 -15408 0 LMT}.. {-2372096592 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Jujuy

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2041
                                                                          Entropy (8bit):3.7481290145270245
                                                                          Encrypted:false
                                                                          SSDEEP:48:5HluuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwcSPAC8OS0E:xwu3pfe92jCs/VOHv2kdeRtnxafwcDCK
                                                                          MD5:995EDE9E1E86DB500C7437A196325E21
                                                                          SHA1:4A8FB1511AA124CA2D299EC8DE155EE9D0479180
                                                                          SHA-256:43EB79ABC03CBAC661C563DE1BC09D9DD855CBC72DD2B6467EA98F0F90421BA9
                                                                          SHA-512:B58B35EA1B2F0388B8108DCF254F3BD1B21894F00A9F313ABC093BC52C36FCDD94B7486DBA38161C9EFCDB12BC3CD81E7E02395B0CA480A7F01148C43CD3054F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Jujuy) {.. {-9223372036854775808 -15672 0 LMT}.. {-2372096328 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\La_Rioja

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2106
                                                                          Entropy (8bit):3.744252944523733
                                                                          Encrypted:false
                                                                          SSDEEP:48:5lduuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0NC:Tou3pfe92jCs/VOHv2kdeRtnxafwwkFP
                                                                          MD5:4A45A063D45EB94214005EF3CA5BCD6D
                                                                          SHA1:2420E8591DC53A39EE1A58B2E45DCFAF9503685F
                                                                          SHA-256:2B018B791E48269FA9EDA12662FFEC3E2DC33603A918E8B735B8D7D6BEB3B3AA
                                                                          SHA-512:0B2824FA3D40B2EDBE8488D50C30368F4CF6E45A39FF6DEBC5BB4FD86F85AD52F5331AD1EB50E5166FA2E735B7E8AA9D94A5FED9421334DB0499524DBE08F737
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/La_Rioja) {.. {-9223372036854775808 -16044 0 LMT}.. {-2372095956 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Mendoza

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2077
                                                                          Entropy (8bit):3.738002814507529
                                                                          Encrypted:false
                                                                          SSDEEP:48:5CPBuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwGSmSc8OSI:GUu3pfe92jCs/VOHv2kdeRtnxafwGJld
                                                                          MD5:F6CB24E8567B2443224E9E17EE438BFE
                                                                          SHA1:8029426C30C4C645EA77C6240391CDB1C3107568
                                                                          SHA-256:DC39400BBFD5BDDDC174FE099194806FBFD3FC3AA20E670D67BE0AC35FE97AD4
                                                                          SHA-512:6869CFC24C21FBB2DFCCAA9AE7E21A0B24DC002EE792FB28A8F2F05C75C20E93C95A39BD8653AA272AF10FE95922B99EECC1208AACE814817D9441F84360E867
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Mendoza) {.. {-9223372036854775808 -16516 0 LMT}.. {-2372095484 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Rio_Gallegos

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2080
                                                                          Entropy (8bit):3.7580685839169545
                                                                          Encrypted:false
                                                                          SSDEEP:48:5oQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0NC:qBu3pfe92jCs/VOHv2kdeRtnxafwwfFP
                                                                          MD5:212D13CE27AF114A8EC2E04023D218C4
                                                                          SHA1:C4C5F86BC6EC0D5EA4C9CF199309D085767B97E8
                                                                          SHA-256:A05B6708DEFF0607396BFC6661C2287341C3432841AE353D94A67AC742B5FAFA
                                                                          SHA-512:CE7201EEA6A86FB49641410D2EEE4030EDB1B96F3218D764762F5AE23883C796F5742ED69CEC985A9D3582D6C72ED74114DE81508F6DEB4B54865B6974ADC965
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Rio_Gallegos) {.. {-9223372036854775808 -16612 0 LMT}.. {-2372095388 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Salta

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2011
                                                                          Entropy (8bit):3.7415813345133975
                                                                          Encrypted:false
                                                                          SSDEEP:48:5NPuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0wF:72u3pfe92jCs/VOHv2kdeRtnxafww3mz
                                                                          MD5:A06C33CDFD7E7B630CB1DF34E72E61E5
                                                                          SHA1:694826B9B910DA0BD70A9CB547C26E6838B08111
                                                                          SHA-256:CAEFC60F2F36EF9FFE0C5921C3C392DE1E95755683A96C1C4EC0BA2C242A4D84
                                                                          SHA-512:D6696A6C14EECF2B77EC586F40137BDD95E5CE5C5193570C809FAB9E5FCA4B8744283CEB6818E525C73F6EFF657274410B2622902EE8C15912C8D5F5FA5C805E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Salta) {.. {-9223372036854775808 -15700 0 LMT}.. {-2372096300 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\San_Juan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2106
                                                                          Entropy (8bit):3.747934819596411
                                                                          Encrypted:false
                                                                          SSDEEP:48:5vXxuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0K:hUu3pfe92jCs/VOHv2kdeRtnxafwwkFl
                                                                          MD5:32A50D0ABF408D9E59C0580D5B8CC472
                                                                          SHA1:EA5BB8860982F8BAFEAEFDE1D6ACD440DA132DFE
                                                                          SHA-256:41B2C25E42146A76934B866061BB3245B8ADA0FF4E1BFBA6F8842A30BDD5C132
                                                                          SHA-512:E5D2521A4EF53AAD3E74506708EC2768C4D2EE8D6D014DCCF4A6DC290B713B4D46021B66527548C35004E10D753E1B685EEFD55BBE7BF01EC6104D7D8AAC4403
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Juan) {.. {-9223372036854775808 -16444 0 LMT}.. {-2372095556 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\San_Luis

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2081
                                                                          Entropy (8bit):3.7399269084699975
                                                                          Encrypted:false
                                                                          SSDEEP:48:5MDuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafw6bS2nZSbdI:yCu3pfe92jCs/VOHv2kdeRtnxafwWnZr
                                                                          MD5:FB06B66F5D41709C7E85C8B1E9BFCFA0
                                                                          SHA1:D5C0C4B12C6190856C300321B1C106C7474BA54B
                                                                          SHA-256:A43B35F25E54EF359D046E33281C0A978F0EE8811C93A6809F1F65750878BBB6
                                                                          SHA-512:D445F46D6A17A075AD995885E45234A711F53BF3FE2DFC6DFBB611E8AC154B10C91E137927DD66D6A7C596A93BAE5DE283796F341B5095FA0DD05595E1C3A077
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Luis) {.. {-9223372036854775808 -15924 0 LMT}.. {-2372096076 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Tucuman

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2105
                                                                          Entropy (8bit):3.741704529449777
                                                                          Encrypted:false
                                                                          SSDEEP:48:5yZujuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OSf:suiu3pfe92jCs/VOHv2kdeRtnxafww3w
                                                                          MD5:D9497141EC0DC172E5FF5304FED0BE6B
                                                                          SHA1:CD20A4F0C127A84791093010D59DF119DD32340A
                                                                          SHA-256:0F7DB23E1280FC19A1FB716E09A9699ADA2AAE24084CAD472B4C325CC9783CCF
                                                                          SHA-512:0B71952055013CD6045ED209FD98168083550655FAB91B7870C92098E40C4FE6827EAAF922D34ECE28298CBB14327A76AD6780D480E552F52F865AA11A4AA083
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Tucuman) {.. {-9223372036854775808 -15652 0 LMT}.. {-2372096348 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Argentina\Ushuaia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2075
                                                                          Entropy (8bit):3.7445758155279836
                                                                          Encrypted:false
                                                                          SSDEEP:48:5SHuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0jE:YOu3pfe92jCs/VOHv2kdeRtnxafwwfFn
                                                                          MD5:16A89FD2CDEE50E534301A9797311A9D
                                                                          SHA1:4A4EBA1798214C7CF5ACDC0B2EC8B4716CD968CB
                                                                          SHA-256:10B6FF51314D8EE1D010187D8805C4E3D71B778BC6DECB26E66193A5BB3E9EA2
                                                                          SHA-512:DBB0BA3F8AA2B54C86EA8B6530C16DF95AF1331FC5F843B113A204DA20B8EF011FE93C27EB917D01B9040D4914057687B4AACCD292A847559AF69150D1BDC4B5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Ushuaia) {.. {-9223372036854775808 -16392 0 LMT}.. {-2372095608 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Aruba

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):199
                                                                          Entropy (8bit):4.893042770292303
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290/V90ppv:MByMYbpwt290/V90b
                                                                          MD5:CC015E3E5D3293CAA1348B4E0EE5795C
                                                                          SHA1:75E7EFD905C9001CE9CA5872DA3915A19BCB00E0
                                                                          SHA-256:7490CD66408B8A14C549278FE67DC3338FE9E458F423F01CCBEA00B5E6F6CEF6
                                                                          SHA-512:66523F050E4A42A1C9FC8C02B822CD3864A6E35F6364FB6A675F2A503BD8030FE6E380B252068668A79A6593B5042520EE40700DA033517742B3F0ED33D79DAF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Aruba) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Asuncion

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7944
                                                                          Entropy (8bit):3.5156463862656775
                                                                          Encrypted:false
                                                                          SSDEEP:192:j7RXBXLqbvdvZsV4GGdzVUFg7XaMOhKpJq3o5GMJq90vRFhjGF3RxTBhcXBACBLo:jEJgXh
                                                                          MD5:181203CAD98E94355B9914A205514904
                                                                          SHA1:D361CB53955437270905A9432DE9E7F6C1AE7189
                                                                          SHA-256:EAEFE21276EE60C7F876C1D65039999AC069339DCDB82A23FC9206C274510575
                                                                          SHA-512:AE9262DFC35579AEB610DF8BB5F7FBB49232195F55F78402405017681F72C0D2A09FA9EB605B406065A1F44FE6785AC0163870C921DAFFC4746DA6EDA3081521
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Asuncion) {.. {-9223372036854775808 -13840 0 LMT}.. {-2524507760 -13840 0 AMT}.. {-1206389360 -14400 0 -04}.. {86760000 -10800 0 -03}.. {134017200 -14400 0 -04}.. {162878400 -14400 0 -04}.. {181368000 -10800 1 -04}.. {194497200 -14400 0 -04}.. {212990400 -10800 1 -04}.. {226033200 -14400 0 -04}.. {244526400 -10800 1 -04}.. {257569200 -14400 0 -04}.. {276062400 -10800 1 -04}.. {291783600 -14400 0 -04}.. {307598400 -10800 1 -04}.. {323406000 -14400 0 -04}.. {339220800 -10800 1 -04}.. {354942000 -14400 0 -04}.. {370756800 -10800 1 -04}.. {386478000 -14400 0 -04}.. {402292800 -10800 1 -04}.. {418014000 -14400 0 -04}.. {433828800 -10800 1 -04}.. {449636400 -14400 0 -04}.. {465451200 -10800 1 -04}.. {481172400 -14400 0 -04}.. {496987200 -10800 1 -04}.. {512708400 -14400 0 -04}.. {528523200 -10800 1 -04}.. {544244400 -14400 0 -04}.. {5

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Atikokan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):187
                                                                          Entropy (8bit):4.791603790249234
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE/qlOi+4IAcGEu5B:SlSWB9vsM3y7oDSHAIgpdN/290/qlf+M
                                                                          MD5:5A45B70C79F533548B3DD332F988E15B
                                                                          SHA1:C7485828619A1D4F5CA59D80ABD197100AC58F64
                                                                          SHA-256:518BEB6E54AE811F8C725EA8CC42787D48FC605A3476D6E7A00A1B5733CBD6AC
                                                                          SHA-512:A81C2EBE282E019ED011EADDB8F74C3E6FBE88D87E8D8706B3022CDCC48EF92AD90F9BCF9F25031664BB6EFE069EAFDD23D9B55BF672FC7528A2DD8CB6B986B4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Atikokan) $TZData(:America/Panama)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Atka

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):177
                                                                          Entropy (8bit):4.812527147763069
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/yO5WXHAIg20/yOoNvWARL/2IAcGE/ol7x+IAcGs:SlSWB9vsM3y7/yrHAIgp/yH0AN/290/e
                                                                          MD5:13479F64BFBDC7583C637E1562C454B4
                                                                          SHA1:2F59484C779B0D6033FC14E205DA9BCAB7A5FCB1
                                                                          SHA-256:1D6FEE336E71FFFB64874A830C976867C071EBF6B133C296B32F87E3E7D814C9
                                                                          SHA-512:D2C5D35BBBDAB8D58BF6185328124796C06B67ADFB4C1828BA5A9CCA500A01BB8BE69635AE7EEA7FA837A27B20D488A08A29B121DD1617BC373390AD95D67E39
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Adak)]} {.. LoadTimeZoneFile America/Adak..}..set TZData(:America/Atka) $TZData(:America/Adak)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Bahia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2012
                                                                          Entropy (8bit):3.703391569010329
                                                                          Encrypted:false
                                                                          SSDEEP:48:5/ChlvEw6kSSx5H4a8tf3fku+da2XUd23t8VZDG8+GyOd:VIlvEwJSSxdF8tfMu+da2kdCt8VZy8+K
                                                                          MD5:69DCC2477D8D81E2F49D295DB6907190
                                                                          SHA1:3C6ED0CEF15D3265C962873480EE1809A4DCACA2
                                                                          SHA-256:64F1EC14F6B43FF10B564F839152E88DF9262F0947D1DB347557FA902F6FD48C
                                                                          SHA-512:71DEA6D47F267AA7326A011872FA74762FA4F8CD57EB149E3B56B3DE9097B0B9258BC4F6C29188B49FC60C1942869B92D9E59FEE6980A5DA5D0029C383D99F39
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bahia) {.. {-9223372036854775808 -9244 0 LMT}.. {-1767216356 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Bahia_Banderas

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6847
                                                                          Entropy (8bit):3.8753284304113196
                                                                          Encrypted:false
                                                                          SSDEEP:48:5pUSdFS1Y3FUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAqyQUrBbp7uos6u:DG1sehpYtpjyrz7nKED4KPddGEYA/Gx
                                                                          MD5:E7EF08880C64C898BB7A5266EBF1A47A
                                                                          SHA1:E2D2F36961C9CADB2736FFAF2DBA9A1F4B372DBD
                                                                          SHA-256:B24AE5FA20F5329644529F660EEC8BAA3B966F9730AF58F1C21E94C02AE17228
                                                                          SHA-512:6C47D875682CCE8B769EB0458CEC20FB8D4950A70D6904A32CED803D30F8B407828D7A12B4F560CF6B86541E985817B4394F9AEAAFEAA80593B5B42BA92D38CB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bahia_Banderas) {.. {-9223372036854775808 -25260 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Barbados

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):648
                                                                          Entropy (8bit):4.251560000277241
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290eWmdH9Colj/uFkv/lC1/uFkOzQs/lps/Ozfah/OzT/lN/uFkX/ll/uFki:5TWeUo5Skv/Y1SkA/g/Bh/m/rSkX/zSt
                                                                          MD5:DC4FA44B2174A4E6F0644FA8EA2E83F9
                                                                          SHA1:C12DF8C862A05D569EAF189272F8BF44303595A1
                                                                          SHA-256:FD5E04136506C6543A9ACDC890A30BCF0D561148E1063EC857E3913DE1EBA404
                                                                          SHA-512:5AC307CD48132B57215CCBAF0BB63F7FA9C5B28DC9F6217C905885D75B0DF131238D4DB2AE707C3DDEE2EDE6C0914644B435FB1CDD9913600D8B69AE95578B0F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Barbados) {.. {-9223372036854775808 -14309 0 LMT}.. {-1841256091 -14400 0 AST}.. {-874263600 -10800 1 ADT}.. {-862682400 -14400 0 AST}.. {-841604400 -10800 1 ADT}.. {-830714400 -14400 0 AST}.. {-820526400 -14400 0 -0330}.. {-811882800 -12600 1 AST}.. {-798660000 -14400 0 -0330}.. {-788904000 -14400 0 AST}.. {234943200 -10800 1 ADT}.. {244616400 -14400 0 AST}.. {261554400 -10800 1 ADT}.. {276066000 -14400 0 AST}.. {293004000 -10800 1 ADT}.. {307515600 -14400 0 AST}.. {325058400 -10800 1 ADT}.. {338706000 -14400 0 AST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Belem

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1031
                                                                          Entropy (8bit):3.8842563546204225
                                                                          Encrypted:false
                                                                          SSDEEP:24:5fe300cChlrLPsw6kSS3h5R14eH8tf3xd:5+CChlvEw6kSSx5H4a8tf3xd
                                                                          MD5:DFA5E50F6AEF1311A4CF74970477E390
                                                                          SHA1:5B63676EB8039B2BE767BAA44820F2DAE5B62876
                                                                          SHA-256:549625CCB30BD0E025BAC47668BA3AA0CDD8569E5887E483C8D62B5B7302FA50
                                                                          SHA-512:4BBB43694E3B54339C549AC3A5488B77366DB1189D8D1834DCF618D9448084A950B575E207064521B1CDFD2E41F7D1D8C5CD9CEB4668D4459585649556136EB0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Belem) {.. {-9223372036854775808 -11636 0 LMT}.. {-1767213964 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Belize

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3284
                                                                          Entropy (8bit):3.8546064195941097
                                                                          Encrypted:false
                                                                          SSDEEP:48:5pKSxZwR9IVQU55DG5krgGN8wW+YeD1yyfCwoc:HKSjgIVzrG5krRN8wWheD1yu
                                                                          MD5:4DA622B685B3B075CC94FC4E23322547
                                                                          SHA1:DEB23F0A434549DAE1BE60ACF757BB212C907B92
                                                                          SHA-256:E07F45264E28FD5AA54BD48CB701658509829CF989EC9BD79498D070A1BA270F
                                                                          SHA-512:9B00BF8870BC4AAEF7F06FCDFEEEF54686A2CC890103696631EB4DEF5AEEAD051EC9069D70A2B22397F18C0067E03A54E75DA18474D6B1BD3BDA2D5313E0AD16
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Belize) {.. {-9223372036854775808 -21168 0 LMT}.. {-1822500432 -21600 0 CST}.. {-1616954400 -19800 1 -0530}.. {-1606069800 -21600 0 CST}.. {-1585504800 -19800 1 -0530}.. {-1574015400 -21600 0 CST}.. {-1554055200 -19800 1 -0530}.. {-1542565800 -21600 0 CST}.. {-1522605600 -19800 1 -0530}.. {-1511116200 -21600 0 CST}.. {-1490551200 -19800 1 -0530}.. {-1479666600 -21600 0 CST}.. {-1459101600 -19800 1 -0530}.. {-1448217000 -21600 0 CST}.. {-1427652000 -19800 1 -0530}.. {-1416162600 -21600 0 CST}.. {-1396202400 -19800 1 -0530}.. {-1384713000 -21600 0 CST}.. {-1364752800 -19800 1 -0530}.. {-1353263400 -21600 0 CST}.. {-1333303200 -19800 1 -0530}.. {-1321813800 -21600 0 CST}.. {-1301248800 -19800 1 -0530}.. {-1290364200 -21600 0 CST}.. {-1269799200 -19800 1 -0530}.. {-1258914600 -21600 0 CST}.. {-1238349600 -19800 1 -0530}.. {-1226860200 -21600

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Blanc-Sablon

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):206
                                                                          Entropy (8bit):4.938043196147077
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290F490ppv:MByMYbpwt290S90b
                                                                          MD5:09FD8280CC890F238126F9641DB7C90E
                                                                          SHA1:98AB4E0DE8173C2BB2532B07FAE2E71F588AB26F
                                                                          SHA-256:FACD0A835D1F425CD323EE453ADE231810B2D1CF6EBA227BA1B50522AE3879F7
                                                                          SHA-512:117C24389B7BFB079F4409B1FA6AA547654D7C69A6CBB19218BF2B96F6CFE3CBAAD400D4C2EFE8A9BFE25F44402057427FC8A62DC20A98018D23A7CF9B87401F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Blanc-Sablon) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Boa_Vista

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1199
                                                                          Entropy (8bit):3.7988385604912893
                                                                          Encrypted:false
                                                                          SSDEEP:24:5EThevwnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQZ:5EHSeSFESoSQSrSsCSeSPS1cSQSQlSsp
                                                                          MD5:9529221F9B4E104CC598491703B10E6C
                                                                          SHA1:5ACD61B525A18DE1919A7484C92EC5D787DF2F25
                                                                          SHA-256:10592EA1CB0D02C06A61059EC601F70A706A5053AC923B9EED29388D5E71EF3A
                                                                          SHA-512:66BEDB631469651A5E426155428764E3C1C14483E6FEE1505812E8676EB6E82CF0A88F6CC697F03FDA0AF906D91C7DE6E940DF3D33DD247BEF51DBD9A13DEE16
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Boa_Vista) {.. {-9223372036854775808 -14560 0 LMT}.. {-1767211040 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Bogota

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):246
                                                                          Entropy (8bit):4.705337479465446
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/290bJhDm2OHDgoHvcuknov/zEXPKV2kR/uFVEV/KVg:MB86290bLmdHDgCvcukCz8O2Y/uF2/Og
                                                                          MD5:DB019451A7D678C3E7AEE706283861F6
                                                                          SHA1:57E63C5372F50CBD1A7FA32688C1B77ADDCC06EB
                                                                          SHA-256:B6ADC16815DC95E537548CA3572D7F93626A6D1DC390DD4CBABAB5AB855BBA30
                                                                          SHA-512:6C94B2D7EFA856E6BD41FC45B0E8D16A40E61D8B895397CD71230047FAD4793DDB9ABAAC57D2841549F161C9389D7E61D54D38F1BAC6F13ED3DD4C68CDD3272C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bogota) {.. {-9223372036854775808 -17776 0 LMT}.. {-2707671824 -17776 0 BMT}.. {-1739041424 -18000 0 -05}.. {704869200 -14400 1 -05}.. {733896000 -18000 0 -05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Boise

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8605
                                                                          Entropy (8bit):3.8563913604109064
                                                                          Encrypted:false
                                                                          SSDEEP:96:eSwtktXNmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:/jXNDPlLv/PCenJzS6cy
                                                                          MD5:005D0BF1320030A7E9CDC97D0C8BB44B
                                                                          SHA1:CB236DA840A49B4BCD261114DCA38DADA567B091
                                                                          SHA-256:93AF910CB2AD2203B71C1AD49D56DF4A4A14D07F885AFD4E755271F1372A517C
                                                                          SHA-512:16A5483392741673BEC020EF6EBE963AB0FB12629D662C586C27A1E9A1BE3FEA8DC3D05A0E84917B8166E48CADA45C74DFABFDC897A6BC94D3C5058D31AD5126
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Boise) {.. {-9223372036854775808 -27889 0 LMT}.. {-2717640000 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-1471788000 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126255600 -25200 0 MST}.. {129114000 -21600 0 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Buenos_Aires

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):239
                                                                          Entropy (8bit):4.821972751564724
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7/MQA+zAHAIgp/MQA+zE5N/290BFzk5h490/MQA+zd:MByMY/MV+zhp/MV+zE5t290rzy490/MW
                                                                          MD5:6700956D5FE96CEC8D34EB49FF805374
                                                                          SHA1:69B9973EF31AE204EFED7485E59CEA99E00815C8
                                                                          SHA-256:DEFC5C9DA2D4D4146145A50D692A6BFF698C3B0A1F19EFD82AD0EE7678F39FCF
                                                                          SHA-512:A80C03A519F00A4270248E885463090A34B3992B3DEBA94DD6AEBCC50736541655461E4AA10856125B8EF9B92CEB697429EE7088DBC6AB4FAE383FDF11521B7A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Buenos_Aires)]} {.. LoadTimeZoneFile America/Argentina/Buenos_Aires..}..set TZData(:America/Buenos_Aires) $TZData(:America/Argentina/Buenos_Aires)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Cambridge_Bay

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7739
                                                                          Entropy (8bit):3.8713679494465016
                                                                          Encrypted:false
                                                                          SSDEEP:96:zsGaLV9T1sF7Lv/PCewtA8CzSPyDLbrcUia:h5lLv/PCenJzS6cy
                                                                          MD5:E6AE12CDB55FED492C253E46E2690FE0
                                                                          SHA1:CD3699E50BC1694827E51E4101C713E52FA646C8
                                                                          SHA-256:3E0506A54B562DBC3AA6889DDD39B327FE0B85C63B00F0B39D606921A0936A59
                                                                          SHA-512:BA3D5D5420210E74E74A581C9678224948266828A8FACE06383E41E13475C682F82D288426FB915D618FFE7ED95BD8F1C7E9D59D31CE5B464D5EC1363AB5E340
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cambridge_Bay) {.. {-9223372036854775808 0 0 -00}.. {-1577923200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}.. {671014800 -21600 1 MDT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Campo_Grande

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2918
                                                                          Entropy (8bit):3.6039149423727013
                                                                          Encrypted:false
                                                                          SSDEEP:48:591PSeSFESoSQSrSsCSeSPS1cSQSQlSsSyZS2SqLSwZS4vSoSUSLpSzS4X3/SxSs:5VsE3LMuJALTvn1ZdP7ZbvLfeAh+KIic
                                                                          MD5:230A9F7A87BA56C30ACB3B1732F823F3
                                                                          SHA1:8263EA723F2AEA7740C7EC54BE0000A06982D765
                                                                          SHA-256:6D5BD1355016B03EDEA58DF98BEC26281CD372725B2DCB60B4D748D2FB4346C8
                                                                          SHA-512:C357AA33833DBBDC6BC7DD3F23469EADDF08564AF17D7EE935C8AEA5F35B6E3BBDE1E181BC0DBF264051C4BE139261055633D191413DD610B0150AB3CDE161AF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Campo_Grande) {.. {-9223372036854775808 -13108 0 LMT}.. {-1767212492 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Cancun

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1412
                                                                          Entropy (8bit):4.034087321254386
                                                                          Encrypted:false
                                                                          SSDEEP:24:5s5edTS/uVV3iVP/uaP/uAyAhbS+V8S+FfS+UvS+MS+FB3S+QS+rcS+kS+RS+dSB:5DziZAmELf0On9uhcinzPPoUlWQW3
                                                                          MD5:7FBCA91F4B7100C4667F24A9AB263109
                                                                          SHA1:163A77FF9EAC49B00B5F838DF4D47F079ECF6A83
                                                                          SHA-256:FD6C370F82E5CFE374637E0E222E72570857AC3F85143BEEEF9C3D0E7A6C0D04
                                                                          SHA-512:124A5D7F58B38F15A90BA48E63D1D38335371D98A2503E691EC6426EB51E87FD61CA05FCA83573DD1DC06DB9E599302C64D226D5DF13B8A62E0A6943318431BE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cancun) {.. {-9223372036854775808 -20824 0 LMT}.. {-1514743200 -21600 0 CST}.. {377935200 -18000 0 EST}.. {828860400 -14400 1 EDT}.. {846396000 -18000 0 EST}.. {860310000 -14400 1 EDT}.. {877845600 -18000 0 EST}.. {891759600 -14400 1 EDT}.. {902041200 -18000 0 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0 CST}.. {1207468800 -18000 1 CDT}.. {1225004400 -21600 0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Caracas

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):284
                                                                          Entropy (8bit):4.588048586971241
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2909+ETlDm2OHXoHv8HkISlvFVFQVgVJUF/R/OXFxWnVVFQVgVVvR/e:MB86290XmdHXCvydSltvAUeFZ/O/qVva
                                                                          MD5:5DDB49759D58931A06740A14F76B431C
                                                                          SHA1:E9AC99265D42D140E12BB4DAAA24FABAC65E79FA
                                                                          SHA-256:D558C25F165E956E980AA8F554AB3BF24E91B51EADBD2B1065EF6DFDA0E2F984
                                                                          SHA-512:318804ED41F36A3A8746C8CD286116787A768B06CAD6057559D1C7105170DE6EAB807EFA52AA8A0E353491B6F8C47D623D4473C1AEAD20B5C00747E07BB282B2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Caracas) {.. {-9223372036854775808 -16064 0 LMT}.. {-2524505536 -16060 0 CMT}.. {-1826739140 -16200 0 -0430}.. {-157750200 -14400 0 -04}.. {1197183600 -16200 0 -0430}.. {1462086000 -14400 0 -04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Catamarca

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):227
                                                                          Entropy (8bit):4.666638841481612
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/29094SXAFB5290/MMXAy:MByMY/MYp/MrRt290mh5290/MK
                                                                          MD5:EEB851BE330BCC44A4831763534058B9
                                                                          SHA1:A5FC3E69DDBD3C40D9EB4317BBD5BB6C78751B36
                                                                          SHA-256:37CD6BDAA6C6EEDFAC3288CA1C11F5CBBE8A17E5F2E790E7635A64B867AFBD87
                                                                          SHA-512:7CD0BC822550325EB3198B4AD6CCD38938FA654A03A09C53117560D1FE3FDCD9C892D105F0D7AF44ED52DD7E0475721240D74A10C98619BE9EC4F5410B8FD87D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Catamarca) $TZData(:America/Argentina/Catamarca)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Cayenne

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.832612867310476
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2IAcGE91INMXGm2OHEFvpoeoHsdR4FIUPvGXFkUwXvp3VVV:SlSWB9eg/2909qDm2OHEdGeoHm4vOXF6
                                                                          MD5:6052E52C8E5A5F43102C47D895797A1F
                                                                          SHA1:23DBD40AE96C84E44ADCD1AC33E7871D217C17BC
                                                                          SHA-256:873285F3E13CB68DD28EB109ECAD8D260E11A9FF6DF6A4E8E0D4C00B0182695B
                                                                          SHA-512:DDE89C70B6F24AD4F585DC5424A6D029E5C898254C9085C588AE699CED4C8316840FF7C87685D7CFAA2E689F01687985454A0C9E3886342E936C56AB688DF732
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cayenne) {.. {-9223372036854775808 -12560 0 LMT}.. {-1846269040 -14400 0 -04}.. {-71092800 -10800 0 -03}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Cayman

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.774923706273939
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE91mr4IAcGEu5pvn:SlSWB9vsM3y7oDSHAIgpdN/2909Yr49F
                                                                          MD5:AD6E086BEDF05A0BEB66990BD9518BEE
                                                                          SHA1:FA0B7E8D6931E79092A90F7EECBA2293AE886AE3
                                                                          SHA-256:C38C49AE1C3E67BD2118002DCFCC3C0EFB6892FB9B0106908A9282C414D0BF2E
                                                                          SHA-512:A1E40422D15DBCB24A6FE353639A1541FAD7F394D20F8AEB32D4E39667BA264C3E815BAA703B88B90D381540168016A0641CA220BACAF05E80EAA698642B6FFA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Cayman) $TZData(:America/Panama)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Chicago

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):11372
                                                                          Entropy (8bit):3.814348526052702
                                                                          Encrypted:false
                                                                          SSDEEP:96:l6u30Ke1rdJ8SUklvgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:l1EKwdJ8SUkl4aUqtfA604qSBgI7DBch
                                                                          MD5:763E23AA7FB20F8D7CB2F0E87FAFD153
                                                                          SHA1:B131A10C1C208BB5E5E178ACD21A679FD0537AC5
                                                                          SHA-256:C7707AF88D650F90839E7258356E39D85228B33B6DBCC5C065C3D8733AE28CEE
                                                                          SHA-512:FE9C5D2EA253338DDFD79CC8ED2F94D6817BD770C0895752EFB1917E2313735C18475D67191C29BCCD53DEFFF35C1BF0CA5D98C92091DDCD1E97CD6302DC73A4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Chicago) {.. {-9223372036854775808 -21036 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1577901600 -21600 0 CST}.. {-1563724800 -18000 1 CDT}.. {-1551632400 -21600 0 CST}.. {-1538928000 -18000 1 CDT}.. {-1520182800 -21600 0 CST}.. {-1504454400 -18000 1 CDT}.. {-1491757200 -21600 0 CST}.. {-1473004800 -18000 1 CDT}.. {-1459702800 -21600 0 CST}.. {-1441555200 -18000 1 CDT}.. {-1428253200 -21600 0 CST}.. {-1410105600 -18000 1 CDT}.. {-1396803600 -21600 0 CST}.. {-1378656000 -18000 1 CDT}.. {-1365354000 -21600 0 CST}.. {-1347206400 -18000 1 CDT}.. {-1333904400 -21600 0 CST}.. {-1315152000 -18000 1 CDT}.. {-1301850000 -21600 0 CST}.. {-1283702400 -18000 1 CDT}.. {-1270400400 -21600 0 CST}.. {-1252252800 -18000 1 CDT}.. {-1238950800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Chihuahua

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6814
                                                                          Entropy (8bit):3.8786702185951305
                                                                          Encrypted:false
                                                                          SSDEEP:96:bo1GK5+yBEzg4GaaECHm3FL5TInckNSNi:m5+yBEzVWEaOkv
                                                                          MD5:1C8647651377A373D573DCD21001CC0A
                                                                          SHA1:EFFE86F9A5C55FAB00415DD0A103B00AA6B237C6
                                                                          SHA-256:A816DC1C4C2FB7509A50CB209D748DAC27C5F858A2842D7E12B2EC620FEA988B
                                                                          SHA-512:5E78696E68FD13F1C45D880E49D121A7761CC5747060ADA0756D805B9DB6816DBE7054C88EC5BA0ED4C05D8EA019388195520A4B231E36F47BE99C542108481A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Chihuahua) {.. {-9223372036854775808 -25460 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {820476000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {883634400 -21600 0 CST}.. {891766800 -21600 0 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -25200 0 MST}.. {1143968400 -

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Coral_Harbour

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):192
                                                                          Entropy (8bit):4.844590153688034
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE9WtEaQXs+IAcGEi:SlSWB9vsM3y7oDSHAIgpdN/2909qEacn
                                                                          MD5:A0BF04CD77026DC1D2749848AB0EE45E
                                                                          SHA1:EA0F1BC11379DF2E421675BC5DE4805CE94B96D6
                                                                          SHA-256:C8CBF5A29CC1D0827390CA6E98B2EFCF90743C6DD0ECA143B300050DD4164041
                                                                          SHA-512:61968B4E42ECC60C801F959D18D13187AD39D9B81FA1A947F6B6862F99D73E3A30849AC4233DB5705D46F5373C42D8748B15BE9B82822971B4F47E601E5766D8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Coral_Harbour) $TZData(:America/Panama)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Cordoba

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):219
                                                                          Entropy (8bit):4.78887878252354
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7/MSHAIgp/M1ovN/29093+90/M7:MByMY/M7p/M16t290c90/M7
                                                                          MD5:C7CCF5CEC7AA60D6063D1C30F4263ADC
                                                                          SHA1:FD8E9AEEEE50656FD3C694CA051895DDC8E5590B
                                                                          SHA-256:28B84710EADEF7AD5E7FA63EF519A9D93996D3BB91DD9018333DE3AC4D8FB8DD
                                                                          SHA-512:6974F8B238977EE5222368C4B79327BB240580819FCA082261D6994781144D81E2E8843B4F1C9D07EFBEE27311C8930BDAC9C0D6D6718F6FB1600D0000576CDE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Cordoba) $TZData(:America/Argentina/Cordoba)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Costa_Rica

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):431
                                                                          Entropy (8bit):4.506976345480408
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290lnmdHd5CvZN/Mi3yvI8/uF+wSJz/uF+IA/uF+i/X8/uF+ZDVxNv:5mnedIvZN/e5S+w+S+LS+i0S+pB
                                                                          MD5:0446EF1A6985A62EDFFB9FFAC7F1DE0E
                                                                          SHA1:A43468E120E585E2DCC20205BA1D1E2CCB6C0BC2
                                                                          SHA-256:E3061DC6FA9F869F013351A9FDF420448592D7F959C2B4404093432508146F7E
                                                                          SHA-512:86D41B0C49489572C3EAEDD5466AA92319C721CCEC9437EBB0F2AAD772FB5ED91A2F2061E00448FB48096B0BAAE9A4E1E644F8AF595B76BE05DBC0C801E6D6ED
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Costa_Rica) {.. {-9223372036854775808 -20173 0 LMT}.. {-2524501427 -20173 0 SJMT}.. {-1545071027 -21600 0 CST}.. {288770400 -18000 1 CDT}.. {297234000 -21600 0 CST}.. {320220000 -18000 1 CDT}.. {328683600 -21600 0 CST}.. {664264800 -18000 1 CDT}.. {678344400 -21600 0 CST}.. {695714400 -18000 1 CDT}.. {700635600 -21600 0 CST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Creston

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.8664633847782905
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/2IAcGE9mM7x/h4y:SlSWB9vsM3y7OBHAIgpONYyHN/2909vr
                                                                          MD5:0757DD22C0E297CCE8E6678ECA4B39C7
                                                                          SHA1:81B31299F9A35C8BA2EC1F59EC21129FFCDCD52F
                                                                          SHA-256:A01DDB460420C8765CE8EF7A7D031ABD7BDB17CFA548E7C3B8574C388AA21E17
                                                                          SHA-512:F1AFC0F6371A10E4CB74FB2C8985610AEE6C3511861BC09384EDC99D250E9099A1F4430BFC3B0B396C2702BF9991A5A4ECFD53A82C92883460715FA2C1E04579
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:America/Creston) $TZData(:America/Phoenix)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Cuiaba

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2912
                                                                          Entropy (8bit):3.588248620238414
                                                                          Encrypted:false
                                                                          SSDEEP:48:5tSeSFESoSQSrSsCSeSPS1cSQSQlSsSyZS2SqLSwZS4vSoSUSLpSzS4X3/SxS1S4:rVsE3LMuJALTvn1ZdP7ZbvLfeAh+KIil
                                                                          MD5:264E0CEA9491B404993594E64F13479F
                                                                          SHA1:6D4D277FA470A2C7AD0A59B5DA3CC15BEEB74E78
                                                                          SHA-256:2D8281CF3FD9E859C5206F781E264854FA876CB36562A08C6C01343C65F8A508
                                                                          SHA-512:759C19B4DD0E1F7F1176872806BFB1F17ADF9C992E41B96FEA67D77DD67E9DD3C1683E3B6D27FB092C731F534C6A7441BACFFF0301907217A064523B86992E23
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cuiaba) {.. {-9223372036854775808 -13460 0 LMT}.. {-1767212140 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200 -1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Curacao

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):201
                                                                          Entropy (8bit):4.876961543280111
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2909C4e90ppv:MByMYbpwt290690b
                                                                          MD5:9459043060E33E8EDC74E78332E96EDF
                                                                          SHA1:27963FE063965584D0F226BAE9A08EB2954398F0
                                                                          SHA-256:ACCF08CF53C9431E226714DF8BEDE3C91BAF62D5BD7B98CA8B50D7258124D129
                                                                          SHA-512:215D9AFAA7227F4447177CE2ABA5A6F7F2F46A9D787845DD32F10D5C22BF9CBE4047AF5E0E66FA7A4F70EEE064A7EC7B67949E565C3C5C60C31F3C19D6915D76
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Curacao) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Danmarkshavn

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1128
                                                                          Entropy (8bit):3.8794180227436557
                                                                          Encrypted:false
                                                                          SSDEEP:24:5geNrmFQqFi77FkiVFw1ZFt9SFUXDFH9vMF0mFdS/FyMF8AWXF7HFEJF7cSXHVFS:5/vx7O11pbzvZ+S0xAqe12vey
                                                                          MD5:6E37A78AC686A6B48A78541E1900E33C
                                                                          SHA1:D41F39FDB6D45921B57341E95A006251B4875961
                                                                          SHA-256:968C56F1D0106E1D92C7B094EEF528B6EE1FFA3D7A18BE2F2BA59178C2C0F1E0
                                                                          SHA-512:397623149D95FF9A094750EE697F62DF90124BBBE407FB49FBAE335A61629449F2A61EF4471DBD57745B323DFCF3628611CAE9295F2EF7E4A7412A697651FF68
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Danmarkshavn) {.. {-9223372036854775808 -4480 0 LMT}.. {-1686091520 -10800 0 -03}.. {323845200 -7200 0 -02}.. {338950800 -10800 0 -03}.. {354675600 -7200 1 -02}.. {370400400 -10800 0 -03}.. {386125200 -7200 1 -02}.. {401850000 -10800 0 -03}.. {417574800 -7200 1 -02}.. {433299600 -10800 0 -03}.. {449024400 -7200 1 -02}.. {465354000 -10800 0 -03}.. {481078800 -7200 1 -02}.. {496803600 -10800 0 -03}.. {512528400 -7200 1 -02}.. {528253200 -10800 0 -03}.. {543978000 -7200 1 -02}.. {559702800 -10800 0 -03}.. {575427600 -7200 1 -02}.. {591152400 -10800 0 -03}.. {606877200 -7200 1 -02}.. {622602000 -10800 0 -03}.. {638326800 -7200 1 -02}.. {654656400 -10800 0 -03}.. {670381200 -7200 1 -02}.. {686106000 -10800 0 -03}.. {701830800 -7200 1 -02}.. {717555600 -10800 0 -03}.. {733280400 -7200 1 -02}.. {749005200 -10800 0 -03}.. {764730000 -72

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Dawson

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2967
                                                                          Entropy (8bit):3.9564096415565855
                                                                          Encrypted:false
                                                                          SSDEEP:24:5IeVvxBn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5zxKKpj/AOZFCARCeQbvb5wxMN6Ix
                                                                          MD5:F494405F3B250668BE00DC3864B9A2DC
                                                                          SHA1:20843AD6D95DD5D5950E2946BCAE4ECE2B676F70
                                                                          SHA-256:30E875343C81C8DE473E6313A27C55315F38E7CCDBD2CEE5783EC54D269D5807
                                                                          SHA-512:9102BD114436D5FE5A1942E31AE692ECE41F910AC1B6E52C02283801D5AA00CFF22D980C61E69928267D3DD34331E301C7324CA631B71AC2FBBDE06D7914F849
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Dawson) {.. {-9223372036854775808 -33460 0 LMT}.. {-2188996940 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800 0 P

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Dawson_Creek

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1940
                                                                          Entropy (8bit):4.024810417421672
                                                                          Encrypted:false
                                                                          SSDEEP:24:5/eUv5wk7Zw9JmnRsw78wP+7bw+7zwN7SynwpBZ7Fwk47H+wW73wo5775w572Iwl:5DuY/YRRvkGZ+R64CjSUlTGS
                                                                          MD5:7868720D39782147B2BD6B039A5BF7E0
                                                                          SHA1:6F66404E5CCFF7F020269A316D792D5E7AD4C280
                                                                          SHA-256:540804BECDEAB92340EF02D32A62BFD550B71A3DB8D829BE426EE4D210004643
                                                                          SHA-512:9CCD124FF954CA2988F07286FFE9ED740E0CEF5F4D76BF090367B74A577E91BF5590EDFE12AFC83ACF5CBFC88C5A68867C58082A2777D08C326A7B18889B08E2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Dawson_Creek) {.. {-9223372036854775808 -28856 0 LMT}.. {-2713881544 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-725817600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400082400 -25200 1 PDT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Denver

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8920
                                                                          Entropy (8bit):3.8540632258197514
                                                                          Encrypted:false
                                                                          SSDEEP:96:gjGtwmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:gUwDPlLv/PCenJzS6cy
                                                                          MD5:0D649599A899ECB3FCF2783DCEE3E37B
                                                                          SHA1:ACC796BE75F41A12FB1F8CCBD2B2839AF9876FFE
                                                                          SHA-256:3FE2EE8C05C5D6F268B58BD9FC3E3A845DEA257473B29F7B3FB403E917448F3C
                                                                          SHA-512:C10D41AB95439B8E978F12F9F58D1ACC9AD15404123FA5FBA0D1CC716E5CF5DA6BD2252450055AC3998DBCB8DD49F7A82ACD53413E3EE78CDA2C42F603DE2C56
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Denver) {.. {-9223372036854775808 -25196 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-1577898000 -25200 0 MST}.. {-1570374000 -21600 1 MDT}.. {-1551628800 -25200 0 MST}.. {-1538924400 -21600 1 MDT}.. {-1534089600 -25200 0 MST}.. {-883587600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-757357200 -25200 0 MST}.. {-147884400 -21600 1 MDT}.. {-131558400 -25200 0 MST}.. {-116434800 -21600 1 MDT}.. {-100108800 -25200 0 MST}.. {-94669200 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -2

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Detroit

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8430
                                                                          Entropy (8bit):3.826664943157435
                                                                          Encrypted:false
                                                                          SSDEEP:96:SGiS1A5tCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:SG/K5ItON0HY2iUmUFLqU
                                                                          MD5:2BBA922E9377D257CBDF6E1367BBB1A2
                                                                          SHA1:6F33A44834E8041E78660A326A5DDAF3D7F9DC2A
                                                                          SHA-256:84F6897B87D3978D30D35097B78C55434CE55EB65D6E488A391DFC3B3BB5A8FE
                                                                          SHA-512:D225824945C08A3521A8288B92B26DFFA712ED3505E72DEDE4A7D1777E58DEA79ADF3F042D22624E4142DD4203BAA4DFF8EB08B7033FDF00059F6C39954EA1A1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Detroit) {.. {-9223372036854775808 -19931 0 LMT}.. {-2051202469 -21600 0 CST}.. {-1724083200 -18000 0 EST}.. {-883594800 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-757364400 -18000 0 EST}.. {-684349200 -14400 1 EDT}.. {-671047200 -18000 0 EST}.. {-80506740 -14400 0 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {94712400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {157784400 -18000 0 EST}.. {167814000 -14400 0 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Dominica

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):202
                                                                          Entropy (8bit):4.86856578093135
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290TL3290ppv:MByMYbpwt290Tr290b
                                                                          MD5:398D8DBB24CEA2D174EF05F63869C94A
                                                                          SHA1:6D0E04165952E873E6ECA33A0E54761B747F0A98
                                                                          SHA-256:3DA98AA7D3085845779BE8ED6C93CCBDA92191F17CA67BBF779803E21DA2ABF3
                                                                          SHA-512:2652AFD1A3F8A4B84078A964005FE10C64491EC2D47CDE57D5066D07D1D837308FD696F53B9E7B6B0E72F86F9A85128B8CBF5F302F91EADE6D840DF946DE85CD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Dominica) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Edmonton

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8600
                                                                          Entropy (8bit):3.8579895970456137
                                                                          Encrypted:false
                                                                          SSDEEP:96:7SabOGaLm911sF7Lv/PCewtA8CzSPyDLbrcUia:7vf4lLv/PCenJzS6cy
                                                                          MD5:EBD169ECA4D45EED28BF7B27809361BC
                                                                          SHA1:E89C8484A29D792FB6349CFDFDD30C2FA6B78B6B
                                                                          SHA-256:026D51D73D30A3710288F440E0C337E44E3A14D0AA2D7B6C6E53AF43FC72A90C
                                                                          SHA-512:45C936ED7D4AF95261180547013454AAEC9FA7672B52AC6077DD99D9FEB6DDD57652FE4EC67BF81F1588384F3027A1872E0C72D9CAEB980B66D2CB6EE9B8ABB0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Edmonton) {.. {-9223372036854775808 -27232 0 LMT}.. {-1998663968 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1600614000 -21600 1 MDT}.. {-1596816000 -25200 0 MST}.. {-1567954800 -21600 1 MDT}.. {-1551628800 -25200 0 MST}.. {-1536505200 -21600 1 MDT}.. {-1523203200 -25200 0 MST}.. {-1504450800 -21600 1 MDT}.. {-1491753600 -25200 0 MST}.. {-1473001200 -21600 1 MDT}.. {-1459699200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {136371600 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {167821200 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {23072

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Eirunepe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1230
                                                                          Entropy (8bit):3.7989525000422963
                                                                          Encrypted:false
                                                                          SSDEEP:24:5OXUepdkZss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6w:5OXCZsMw57XJh4CxUF/A6GTrtSUUhfL0
                                                                          MD5:6766E75702D8C2D1C986DFCEFCE554F9
                                                                          SHA1:39553F80D82BC0134FAF70C9830B96BDCBCEFF1C
                                                                          SHA-256:48FC987E5999EA79F24797E0450FE4DAB7CF320DFAD7A47A8A1E037077EC42C9
                                                                          SHA-512:A812D0D4254BB0B7DB7AE116652D2A8F97D22C59F2709A17D1CE435FCFB38B807A4E0ED6EA114A66897E29D85226875FA84D28B254A5D17BD1CBA95FAD8349B7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Eirunepe) {.. {-9223372036854775808 -16768 0 LMT}.. {-1767208832 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {571204800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\El_Salvador

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):279
                                                                          Entropy (8bit):4.760311149376001
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/29078iPDm2OHvJ4YoHxHhgdrV/uF+IcmJ3/uF+ivNv:MB8629078AmdHx4YCJSB/uF+QV/uF+w9
                                                                          MD5:CEF7277443EB6990E72C7EA7F79A122C
                                                                          SHA1:1D3FEA364B3DC129DE3998A1455D5588EBAA6FF8
                                                                          SHA-256:C02C6E79398553BD07BEA0BE4B7F0EBDD8BC821595909CFFB49DE4290A0D1D0F
                                                                          SHA-512:E6FC530B2CCF010B8D38BC3F49A6859B5C68F4AB604E6305CE75FBE4FC9FF3FCD0187DEBEF6DAE652EEF9695568DBDE31F426E404CC3CC206D78183E0D919234
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/El_Salvador) {.. {-9223372036854775808 -21408 0 LMT}.. {-1546279392 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Ensenada

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.836337676384058
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qfSfXHAIg20qfORL/2IAcGE7JM7QIAcGEqfBn:SlSWB9vsM3y7ekHAIgpeON/2907390eB
                                                                          MD5:005D9C0E50291616A727CFB74A9FD37E
                                                                          SHA1:846AE6720382B4F67B37B4256E45246C81DAF899
                                                                          SHA-256:3E363BF82545F24CCE8CFA6EEC97BA6E1C2A7730B2A9CE6C48F784821D308A5D
                                                                          SHA-512:452326D11D01825764BC40A77D17444D822F3AA202582233DD8B122798478FA83E3A27A02508EAC4CF0C7922AC2563742D773AA870562AE496B34FBB41FBAD63
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Ensenada) $TZData(:America/Tijuana)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Fort_Nelson

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4578
                                                                          Entropy (8bit):3.8944281193962818
                                                                          Encrypted:false
                                                                          SSDEEP:48:5QIgsB/YRRvkGZ+R64CjSUlTG5Al5pj/A1ZFCARCeQbvb5+:6IgzR864CjSETG5sjgZkR/bvt+
                                                                          MD5:4A4E023F635C4202018EA9E8F85B5047
                                                                          SHA1:38E121FE2D419413E9E791B6C22BFC8D9F7554BC
                                                                          SHA-256:AB15023807E7C7D1026C9970D190F1B405D48952464025242C2BB6C6BBB8391A
                                                                          SHA-512:F10D21A2C841224879D1C817FC7F477DF582E1BC3603666B55199C098D51D1D5429F8C088C1083C07FC7588AE5C42A1DFBCC6B7C636AD1BE84ED657807A229E5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Fort_Nelson) {.. {-9223372036854775808 -29447 0 LMT}.. {-2713880953 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-725817600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Fort_Wayne

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):231
                                                                          Entropy (8bit):4.778858143786314
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/290HXYAp4903GK8:MByMY3GK7Kp3GKnt290Hz4903GK8
                                                                          MD5:24C369A3091452DCA7AAEBF4F48F5289
                                                                          SHA1:2C2174CB16F490689E6FAC17B6D18F4A0DBD2DC9
                                                                          SHA-256:C8948616262CF6990739343ABBBD237E572DB49310099E21DD8F9E317F7D11B3
                                                                          SHA-512:80F579572754579706B4EEA49BF30456F3231A308E0616DC430E2428A04992412773421542E4F7FE4E4C7491BA88942FA44B49E87E95A2183211AC2AB523B231
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:America/Fort_Wayne) $TZData(:America/Indiana/Indianapolis)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Fortaleza

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1423
                                                                          Entropy (8bit):3.784027854102512
                                                                          Encrypted:false
                                                                          SSDEEP:24:5MeajcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaIBXR8nd:5rChlvEw6kSSx5H4a8tf3fkuoYVZDNRo
                                                                          MD5:E7939C9A3F83D73B82A6DE359365EFD4
                                                                          SHA1:06D6E257DA7C317CAFAF6C0B04567A2453CC1660
                                                                          SHA-256:C0A836BDAF07F0376B7B0833A0AB3D52BA6E3E1D6F95E247E1AD351CD1096066
                                                                          SHA-512:E2BEA04084489B26ADD9A768D2580C1FF7EBAC8A3EA36818F49E85FB14E01500D59D53904F5A17F4DABEF27B4CC2FC3F977EE4C125E5CE739BBE90C130ED3B07
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Fortaleza) {.. {-9223372036854775808 -9240 0 LMT}.. {-1767216360 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Glace_Bay

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8372
                                                                          Entropy (8bit):3.8225708746657316
                                                                          Encrypted:false
                                                                          SSDEEP:192:w4lTPB10KvnpNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/BI:wKCC
                                                                          MD5:1C8B0B85BB5578E84A4867546111F946
                                                                          SHA1:E08A96F5B369FA53BC1F3F839EC14FF9D334F727
                                                                          SHA-256:58C207CBD9DE7A7BB15E48A62CEA9F15DA184B945133DEE88EFF29FD8B66B29E
                                                                          SHA-512:54CFBF208AB3E58AFB6BEC40265A452A3C4C684D7F278F51D6495FCA544652A1A5E05BC45F600911191B33C936E5D7D43A28FD2B0884AAB9F63B7AD5EFD574A1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Glace_Bay) {.. {-9223372036854775808 -14388 0 LMT}.. {-2131646412 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-536443200 -14400 0 AST}.. {-526500000 -10800 1 ADT}.. {-513198000 -14400 0 AST}.. {-504907200 -14400 0 AST}.. {63086400 -14400 0 AST}.. {73461600 -10800 1 ADT}.. {89182800 -14400 0 AST}.. {104911200 -10800 1 ADT}.. {120632400 -14400 0 AST}.. {126244800 -14400 0 AST}.. {136360800 -10800 1 ADT}.. {152082000 -14400 0 AST}.. {167810400 -10800 1 ADT}.. {183531600 -14400 0 AST}.. {199260000 -10800 1 ADT}.. {215586000 -14400 0 AST}.. {230709600 -10800 1 ADT}.. {247035600 -14400 0 AST}.. {262764000 -10800 1 ADT}.. {278485200 -14400 0 AST}.. {294213600 -10800 1 ADT}.. {309934800 -14400 0 AST}.. {325663200 -10800 1 ADT}

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Godthab

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.973070790103308
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wQbSeyXHAIg20wQboAFARL/2IAcGE5GZJ4IAcGEH:SlSWB9vsM3y7lbSeSHAIgplbLFAN/291
                                                                          MD5:8263D2B39C2EC3B38A179F8BAD5972DD
                                                                          SHA1:18D3462F6846768E16036E860DE90FB345C93047
                                                                          SHA-256:5FB2CFBA25CE2F49D4C3911AFF8E7E1FF84EFC2D01F5783772E88246BFBC56AC
                                                                          SHA-512:C175CAF972459759553001D48921268E9C6268CED56021BA6339F8CE3DD032DA6180E2B82974D3DCD0DC5F21566DFDBFBE1B6CF24E5E893F2335A449452DB27F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Nuuk)]} {.. LoadTimeZoneFile America/Nuuk..}..set TZData(:America/Godthab) $TZData(:America/Nuuk)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Goose_Bay

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):10353
                                                                          Entropy (8bit):3.864463676759425
                                                                          Encrypted:false
                                                                          SSDEEP:192:zfSacO8f7/ewzlrfFj18KvnpNWMPm4bPJvSuYUHgA0G19OBYEi/B51B7/Bm6BTdW:zfSacOI7/V3SuYUHgAuCC
                                                                          MD5:0D646C67105FD0525E7CCC79585CE9DF
                                                                          SHA1:06D91FDD8FEEDC299E40079569372F97A9AC6F04
                                                                          SHA-256:52D2478289682BF95BFB93D64D679E888C9D23C0F68DFFF7E6E34BFC44B3D892
                                                                          SHA-512:FD672613C2B65E12425415630A2F489917EB80DDED41338C9AA7D5D3C6B54E52C516A32493593F518DACF22A91D7A9D2C96DB9C5F1BE2C3BB9842D274BDC04FF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Goose_Bay) {.. {-9223372036854775808 -14500 0 LMT}.. {-2713895900 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1096921748 -12600 0 NST}.. {-1072989000 -12600 0 NST}.. {-1061670600 -9000 1 NDT}.. {-1048973400 -12600 0 NST}.. {-1030221000 -9000 1 NDT}.. {-1017523800 -12600 0 NST}.. {-998771400 -9000 1 NDT}.. {-986074200 -12600 0 NST}.. {-966717000 -9000 1 NDT}.. {-954624600 -12600 0 NST}.. {-935267400 -9000 1 NDT}.. {-922570200 -12600 0 NST}.. {-903817800 -9000 1 NDT}.. {-891120600 -12600 0 NST}.. {-872368200 -9000 0 NWT}.. {-769395600 -9000 1 NPT}.. {-765401400 -12600 0 NST}.. {-757369800 -12600 0 NST}.. {-746044200 -9000 1 NDT}.. {-733347000 -12600 0 NST}.. {-714594600 -9000 1 NDT}.. {-701897400 -12600 0 NST}.. {-683145000 -9000 1 NDT}.. {-67044

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Grand_Turk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7522
                                                                          Entropy (8bit):3.84007813579738
                                                                          Encrypted:false
                                                                          SSDEEP:96:pGStCt/cL1BRv0HY2iU7KKdFL6Aa2K4gSLf8e:pvItOx0HY2iUmUFLqU
                                                                          MD5:A17723CE27EC99D1506C45AB1531085B
                                                                          SHA1:A83ED7BD09514A829CC8F2EA47BA113F5DCA1090
                                                                          SHA-256:560B39485CED4C2A0E85A66EB875331E5879104187D92CB7F05C2F635E34AC99
                                                                          SHA-512:110D1253D6915DB046247E4FD3BA9B881146BC3896DE779215E0CC6D1DCC59958C355441955509F5D38E3A3BA166DFD0F2F277000E9E89D6551FBEA0C16974B9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Grand_Turk) {.. {-9223372036854775808 -17072 0 LMT}.. {-2524504528 -18430 0 KMT}.. {-1827687170 -18000 0 EST}.. {284014800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}.. {483519600 -14400 1 EDT}.. {499240800 -18000 0 EST}.. {514969200 -14400 1 EDT}.. {530690400 -18000 0 EST}.. {544604400 -14400 1 EDT}.. {562140000 -18000 0 EST}.. {576054000 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607503600 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638953200 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671007600 -14400 1 EDT}.. {688543200 -18000 0 EST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Grenada

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):201
                                                                          Entropy (8bit):4.892013473075135
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2905Qb90ppv:MByMYbpwt290Ob90b
                                                                          MD5:4B9ABEA103F55509550F8B42D88E84B7
                                                                          SHA1:E3AA1BCE5E260264E74F77E59C4071B7E496AB41
                                                                          SHA-256:EBED070E8E67C5F12FF6E03FE508BE90789F17C793DFE61237B4045B8222580F
                                                                          SHA-512:568E375464FF264C5048CB35995945BDE1D5BCC3A108B2A4D0F8389EBF18B4C58EBB1C2122F10BA777D512504A59C7EFDF6069EABD2A5DEA3189204B7F7A6EB4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Grenada) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Guadeloupe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):4.9138787435596765
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2905AJLr490ppv:MByMYbpwt290qJLr490b
                                                                          MD5:92B091A06198E233B73DF12DFCD818D5
                                                                          SHA1:C529488D09F86755E4F22CB4F0E3013C3A1B978D
                                                                          SHA-256:6CB1930532831D12057FCB484C60DB64A60A4F6D8195DAFD464826923116A294
                                                                          SHA-512:55EAE03CDECAC43BEDD3AA1A32C632A46808F29FF4D97A330F818544E4D10B9E9BA909D6627C38065EB7AC8E2C395FA37797F532CCFC8AB89D4698CCDE17F985
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Guadeloupe) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Guatemala

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):399
                                                                          Entropy (8bit):4.513185345162455
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862906GGmdHKznC972f/uF+mP/uF+K67Jqd3/uF+eBxE/uF+DAWNv:5neQCgfS+6S+K67Yd3S+e0S+1
                                                                          MD5:569CDE7CE1AB84C0F16A25E85A418334
                                                                          SHA1:EADE79AB6EDD98C7FE8B10B480C5C530CA014F5C
                                                                          SHA-256:14F6A98D602F3648C816B110F3A0BA375E1FFE8FA06BEEAB419DC1ABFA6EDCAF
                                                                          SHA-512:AE2ACBF09EED857906811BE2984D6BF92BF2955A9FE2F9F3FFEBB6790902F5C2C870F8561CA13AD9CB7826EECA434BED7CFE7D0D2739996BACEE506D0EB730DC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guatemala) {.. {-9223372036854775808 -21724 0 LMT}.. {-1617040676 -21600 0 CST}.. {123055200 -18000 1 CDT}.. {130914000 -21600 0 CST}.. {422344800 -18000 1 CDT}.. {433054800 -21600 0 CST}.. {669708000 -18000 1 CDT}.. {684219600 -21600 0 CST}.. {1146376800 -18000 1 CDT}.. {1159678800 -21600 0 CST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Guayaquil

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):249
                                                                          Entropy (8bit):4.745656594295655
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2905xDm2OHHjGeoHv5laITicKpKV0EX/uFhfF/KVg:MB86290jmdHHLCv5FT/gOR/uFpF/Og
                                                                          MD5:DF661E312C6CE279CD6829120BE33CF2
                                                                          SHA1:4ACDB31E27EF9175C5452BF95F94F9BC280A237F
                                                                          SHA-256:6806AA5814BDC679C6EF653C518D2699114BE71D973F49C0864F622038DC2048
                                                                          SHA-512:04E7FD01F4DAD981EE8A02487F4A889015C41D07D6DCF420183D387E2188FF3239E345B5D65FB195CA485F5C7B4AD8CFEF51FFFC11EE0C91F0C88FF7B7EF17C1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guayaquil) {.. {-9223372036854775808 -19160 0 LMT}.. {-2524502440 -18840 0 QMT}.. {-1230749160 -18000 0 -05}.. {722926800 -14400 1 -05}.. {728884800 -18000 0 -05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Guyana

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):248
                                                                          Entropy (8bit):4.673559445766137
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2905R3SDm2OHRLx5oH8ZOXFxSyZ1yV/KMMdVVFAKFZ4KVR/ON:MB86290LGmdHBnC8ZODhyV/4d/OeZ4Ke
                                                                          MD5:F06C226D8D53EF8859AD91D7EBA5959C
                                                                          SHA1:E0B4E6F4ADCB10F1D79FFD928E8684FFE0C0DC5F
                                                                          SHA-256:4078D2E361D04A66F22F652E3810CDF7F630CF89399B47E4EC7B1D32B400FD85
                                                                          SHA-512:B4385650A0C69B7BD66415CC4BB9FCA854DBB1427E9F2D6C1D8CDB8CCEF9ECBD699C66A83A9AC289DABC5CDBB0A2B044E4097E9A2977AE1802B3BF6E2BB518CF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guyana) {.. {-9223372036854775808 -13959 0 LMT}.. {-1843589241 -14400 0 -04}.. {-1730577600 -13500 0 -0345}.. {176096700 -10800 0 -03}.. {701841600 -14400 0 -04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Halifax

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):11124
                                                                          Entropy (8bit):3.8106487461849885
                                                                          Encrypted:false
                                                                          SSDEEP:192:YpQamC9XD81iWQSufutTLBCN8RWnWQ7Z/xVpmtBwXiCDLxcGMe++wzlrfFj10Kvn:2kXCvNc/1/CC
                                                                          MD5:6FB9E47841FF397CE36A36C8280E2089
                                                                          SHA1:DA210300DC3D94FC3D8BA0A4531341BCA5C5936C
                                                                          SHA-256:01E11C7B07925D05E9E1876C310A2B87E0E80EF115D062225212E472B7A964F1
                                                                          SHA-512:F61B5A8A7532BBD54A4976DF17A1C6CF51BCC6DC396482FBE169C3081AF27B6CA863F0CDE3E483C59F5A5BD3365592F6984A97173C736B41D3CEEDAD4263A4E5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Halifax) {.. {-9223372036854775808 -15264 0 LMT}.. {-2131645536 -14400 0 AST}.. {-1696276800 -10800 1 ADT}.. {-1680469200 -14400 0 AST}.. {-1640980800 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-1609444800 -14400 0 AST}.. {-1566763200 -10800 1 ADT}.. {-1557090000 -14400 0 AST}.. {-1535486400 -10800 1 ADT}.. {-1524949200 -14400 0 AST}.. {-1504468800 -10800 1 ADT}.. {-1493413200 -14400 0 AST}.. {-1472414400 -10800 1 ADT}.. {-1461963600 -14400 0 AST}.. {-1440964800 -10800 1 ADT}.. {-1429390800 -14400 0 AST}.. {-1409515200 -10800 1 ADT}.. {-1396731600 -14400 0 AST}.. {-1376856000 -10800 1 ADT}.. {-1366491600 -14400 0 AST}.. {-1346616000 -10800 1 ADT}.. {-1333832400 -14400 0 AST}.. {-1313956800 -10800 1 ADT}.. {-1303678800 -14400 0 AST}.. {-1282507200 -10800 1 ADT}.. {-1272661200 -14400 0 AST}.. {-1251057600

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Havana

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8729
                                                                          Entropy (8bit):3.8227313494100867
                                                                          Encrypted:false
                                                                          SSDEEP:96:BEsWduCtQA/gF6Y3Umjm67yLb5RCzhV28I:BBWACb/gF6Y3UmjBy7
                                                                          MD5:564980AECB32F5778422EA15E8956879
                                                                          SHA1:545209C95043721C1839CCE5FEFD1A6F2DE3FE5F
                                                                          SHA-256:96B62BFBF0C05CF970245597C691F89EBF631175796459642A85287F131D0215
                                                                          SHA-512:25FE5DAA55E3466EAE1CDC73918F189403C3360D4E82D72D745FA04A374DE04F479AA9811D6154FC70CC8EA620F18035EA6A3074116806D4405936FA017CE8E6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Havana) {.. {-9223372036854775808 -19768 0 LMT}.. {-2524501832 -19776 0 HMT}.. {-1402813824 -18000 0 CST}.. {-1311534000 -14400 1 CDT}.. {-1300996800 -18000 0 CST}.. {-933534000 -14400 1 CDT}.. {-925675200 -18000 0 CST}.. {-902084400 -14400 1 CDT}.. {-893620800 -18000 0 CST}.. {-870030000 -14400 1 CDT}.. {-862171200 -18000 0 CST}.. {-775681200 -14400 1 CDT}.. {-767822400 -18000 0 CST}.. {-744231600 -14400 1 CDT}.. {-736372800 -18000 0 CST}.. {-144702000 -14400 1 CDT}.. {-134251200 -18000 0 CST}.. {-113425200 -14400 1 CDT}.. {-102542400 -18000 0 CST}.. {-86295600 -14400 1 CDT}.. {-72907200 -18000 0 CST}.. {-54154800 -14400 1 CDT}.. {-41457600 -18000 0 CST}.. {-21495600 -14400 1 CDT}.. {-5774400 -18000 0 CST}.. {9954000 -14400 1 CDT}.. {25675200 -18000 0 CST}.. {41403600 -14400 1 CDT}.. {57729600 -18000 0 CST}.. {73458000 -14400 1 CD

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Hermosillo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):616
                                                                          Entropy (8bit):4.348926042114513
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290e2mdH5NCtXwl3UXbTMmxL+voudQCvX70qKOV9kYNv:5Ie5k9WUuwuz/Vyu
                                                                          MD5:A2192F251D5A62466AF87B90E0EC5ECF
                                                                          SHA1:F86DEC1E79FA877F50DAC1B06FEA870D3C9AA741
                                                                          SHA-256:7391A186F8DE1FDD5A61B3887E65DCDB4A2186BFD36BBFFB464B63D9775E922A
                                                                          SHA-512:AF3E5C13397C315FA7CB7EDB97510283900414A1B9A25EC9C91115D5F80267162FDD2220D8E49D57561A4B331D70706BC0A37E8BFF0D8922CD344E3A1BCCECA5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Hermosillo) {.. {-9223372036854775808 -26632 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {915174000 -25200 0 MST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indiana\Indianapolis

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7230
                                                                          Entropy (8bit):3.882344472808608
                                                                          Encrypted:false
                                                                          SSDEEP:96:nys0KHK1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:nyBKHkN0HY2iUmUFLqU
                                                                          MD5:7824B3F2D20F16A9DCC8E0F7DC45C1B8
                                                                          SHA1:77014A0502DA1342EFA41B64C5613839B627354B
                                                                          SHA-256:4B114545167326F066AB3A798180896B43AC6FDC3B80D32BCC917B5A4A2359EB
                                                                          SHA-512:03F6A18C03E79E9177D16CD7AB75AC117197638370FA675BC2854A5A563021F865F3F0672B237B83098787AB9D419AC33D67F28324B1E25AD8560B5838F70807
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Indianapolis) {.. {-9223372036854775808 -20678 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1577901600 -21600 0 CST}.. {-900259200 -18000 1 CDT}.. {-891795600 -21600 0 CST}.. {-883591200 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indiana\Knox

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8755
                                                                          Entropy (8bit):3.8394539560522585
                                                                          Encrypted:false
                                                                          SSDEEP:96:+q2KeNrdJ8SvAgahLi8hDlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:+FKUdJ8SvPaUqbA604qSBgI7DBch
                                                                          MD5:8AF080A022DA0737E94742C50EAAC62E
                                                                          SHA1:704F0565B53AA8A20F70B79A7958D4D07085E07A
                                                                          SHA-256:F1253F5F3F5AACD1A5E1F4636DD4E083F4B2A8BD995CF3E684CDD384641849F1
                                                                          SHA-512:26AAF6D24B2E2B60451E19A514533DFAEC74F01F9B1AEB9F86690669C14130D77AE1CBFB9FC9091E1CD1FC1CBC2799BB05026DB68768C3CCB960355C18D111ED
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Knox) {.. {-9223372036854775808 -20790 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-725824800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.. {-447267600 -21600 0 CST}.. {-431539200 -18000 1 CDT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indiana\Marengo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7273
                                                                          Entropy (8bit):3.8700915866109535
                                                                          Encrypted:false
                                                                          SSDEEP:96:7qvrv7+X1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:7Kv7+bN0HY2iUmUFLqU
                                                                          MD5:C1A10440E6CCE4C5052E2510182D9AA7
                                                                          SHA1:56D4F3CCA1245D626BADA74CF3F6BAE8034BF58D
                                                                          SHA-256:675162381639598E7100E90663D42780F8EE1CB62BD6DA5B948B494F98C02FE3
                                                                          SHA-512:96B71472AD38ECFC589F935D9F5F1C8D42C8E942D8772FB6A77F9B9C0E2BD7A07FA61729E57EC02356121518E33797A784679F8DED2FCA3FC79F5C114783DD57
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Marengo) {.. {-9223372036854775808 -20723 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-599594400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {-21488400 -14400 1 EDT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indiana\Petersburg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7611
                                                                          Entropy (8bit):3.87971256165061
                                                                          Encrypted:false
                                                                          SSDEEP:96:TqervJ8SUklggahyBRP0HY2iU7KKdFL6Aa2K4gSLf8e:TpvJ8SUklvaQN0HY2iUmUFLqU
                                                                          MD5:A86042668CD478AFFC05D3383EDEE8FF
                                                                          SHA1:6476526F94A247C0ECF3B2813F2C5A4FB93E457E
                                                                          SHA-256:23B8FA75CE0A9555DFD84549723A12679FF7FC5FAA58E4B745BA3C547071FF53
                                                                          SHA-512:07A5487A087108E6D6E88580865885CA6243EF04BE8263FC913F38CADB8EA016386E8BBAD39F65FD081F1A2F14316FEAF008855E9CF2019B169D9511916AFF67
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Petersburg) {.. {-9223372036854775808 -20947 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-473364000 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 1 CDT}.. {-257965200 -21600 0 CST}.. {-242236800 -18000 1 CDT}.. {-226515600 -21600 0 CST}.. {-210787200 -18000 1 CDT}.. {-195066000 -21600 0 CST}.. {-179337600 -18000 1 CD

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indiana\Tell_City

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7100
                                                                          Entropy (8bit):3.8613085681914607
                                                                          Encrypted:false
                                                                          SSDEEP:96:yqxrvJ8SUklLgzNA604qSScBgN+4ctDzIVQ/c/3hNxTh:yUvJ8SUkl8BA604qSBgI7DBch
                                                                          MD5:E7FE9B7CFBC6505C446056967DEBC87B
                                                                          SHA1:81ADAD89F040F62E87D2F26D1D98B3E52710F695
                                                                          SHA-256:D368123DB703B55244700876906775837D408C274C5A5801D80B77EADB6D5853
                                                                          SHA-512:9C0746DE18C80B548AA443D59BB9971BDC304975717C5FCDEBDE72828ACF408FA1D687F87C42E7B8D6D0284C9F792EA236BF79C815947BE773D07364B630AC99
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Tell_City) {.. {-9223372036854775808 -20823 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 1 CDT}.. {-257965200 -21600 0 CST}.. {-242236800 -18000 1 CDT}.. {-226515600 -21600 0 CST}.. {-210787200 -18000 1 CDT}.. {-195066000 -21600 0 CST}.. {-179337600 -18000 0 EST

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indiana\Vevay

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6563
                                                                          Entropy (8bit):3.866646181493734
                                                                          Encrypted:false
                                                                          SSDEEP:96:juqv01BRP0HY2iU7KKdFL6Aa2K4gSLf8e:CoKN0HY2iUmUFLqU
                                                                          MD5:2CCFC3980C321ED8A852759C0BCCB12C
                                                                          SHA1:A8BFE02E4E71B28EF8E284E808F6EDE7C231F8FF
                                                                          SHA-256:0623233AA39A1A82038A56DF255ADF49E648777375B8499491C8897EBEA1CDF1
                                                                          SHA-512:A4C77689BC9BF871C756D05BAC4157F0FD324D10AC7D15F3543344C6F8C7FC9218AB7ADFBCE70C8ECCDD6EC15FD7960503FC7A8223FECE6D4227BF0BB04190C7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Vevay) {.. {-9223372036854775808 -20416 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-495043200 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {94712400 -18000 0 EST}.. {1136091600 -18000 0 EST}.. {1143961200 -14400 1 EDT}.. {1162101600 -18000 0 EST}.. {1173596400 -14400 1 EDT}.. {1194156000 -18000 0 EST}.. {1205046000 -14400 1 EDT}.. {1225605600 -18000 0 EST}.. {1236495600 -14400 1 EDT}.. {1257055200 -18000 0 EST}.. {1268550000 -144

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indiana\Vincennes

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7226
                                                                          Entropy (8bit):3.879195938909716
                                                                          Encrypted:false
                                                                          SSDEEP:96:Vq8rdJ5UklpRBRP0HY2iU7KKdFL6Aa2K4gSLf8e:VbdJ5Uklp/N0HY2iUmUFLqU
                                                                          MD5:56D1930F5FAE2456DEC6C9AB1B0233E1
                                                                          SHA1:F6ED52EF769DF2C015C181BCFF3DC0E24497C768
                                                                          SHA-256:B8452B6AA739A78AC6D03806463B03D4175639593E19FAA3CA4B0D0FB77F18C9
                                                                          SHA-512:AFCFF383DB441DA9154B639A88700D0604F487A20E830146B14061E485A991AD8DC279AF8C0C2329265CF14C901207B9058157FAA1C039082EB7630916834156
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Vincennes) {.. {-9223372036854775808 -21007 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-289414800 -21600 0 CST}.. {-273686400 -18000 1 CDT

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indiana\Winamac

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7410
                                                                          Entropy (8bit):3.8775722319777968
                                                                          Encrypted:false
                                                                          SSDEEP:96:uq0KeKrv7c1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:unKxv7yN0HY2iUmUFLqU
                                                                          MD5:880526DC23E7BDB00506D7EC2A885907
                                                                          SHA1:DB3B13A2A4BF80E7B71C7F0604A0A80EF070B9BA
                                                                          SHA-256:4B293FDB7680C4597B8C885333719214492ECF09BD5EA342D1EC15F2BF9C8605
                                                                          SHA-512:42EEDC5EA28781D62A457F4843F38D0A3FEFCAD83BA01B07CEF0FA169C6440960E04BABD272C5E9AF2F4B0DBB2A786EF9221A48F084F16752E6D0EA66C31911E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Winamac) {.. {-9223372036854775808 -20785 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Indianapolis

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):233
                                                                          Entropy (8bit):4.7047837427916095
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/2903GfJ4903GK8:MByMY3GK7Kp3GKnt2903GfJ4903GK8
                                                                          MD5:DEE404D54FD707C4A27F464B5F19D135
                                                                          SHA1:AD95D04738F6B15A93DED1DE6B5FA9F47C8E38CB
                                                                          SHA-256:437DA148B94DBA4CEA402169878541DB9C3419ABAB6750D1C36625DD3053019E
                                                                          SHA-512:421D6AF30F0C64EA6CB9F9DC4E7EF9E8EE5945F81A5E82A6D959D32AD69F325770DB6A07D8F52EFE7EE7F6C3AD4E1F34AA30A6B5E006C928119A54E746D6FE6B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:America/Indianapolis) $TZData(:America/Indiana/Indianapolis)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Inuvik

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7638
                                                                          Entropy (8bit):3.8629745113156004
                                                                          Encrypted:false
                                                                          SSDEEP:96:/nGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:/GPlLv/PCenJzS6cy
                                                                          MD5:DBF9C2CCF786A593C9D6E4F4BB37ACE9
                                                                          SHA1:4D2332A530A36E6DB2802DD9FA2DAF5C0594D5EA
                                                                          SHA-256:5A1F7F5EDAD0251B73C33E7B5DDEE194646E9D3992B169DC1A64D155765D472C
                                                                          SHA-512:70D75371497CED3B6C731C95299CDD5F8F49C3C6EEDDF31EB05D008769D76ACFE8BFA9A2ECE45BD0BA2E279BBEF65945955791EFC04A569F5CAA13665CD2545F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Inuvik) {.. {-9223372036854775808 0 0 -00}.. {-536457600 -28800 0 PST}.. {-147888000 -21600 1 PDDT}.. {-131558400 -28800 0 PST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}.. {671014800 -21600 1 MDT}.. {688550400 -25200 0 MST}.. {702464400 -21600 1 MDT}.. {7200000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Iqaluit

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7671
                                                                          Entropy (8bit):3.832645570123566
                                                                          Encrypted:false
                                                                          SSDEEP:96:7FE5Ct/cQ1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:7FEct/N0HY2iUmUFLqU
                                                                          MD5:8020712BBA127EA8AB52E8F5DB14286E
                                                                          SHA1:DAEBC76FE10770D3FC2B5E1C14823B2B5543BA35
                                                                          SHA-256:AFC4627879F4A618F5E3BA9EA123F3212E161F4CCFD0DF46F3B6B7CD2E2C0D7E
                                                                          SHA-512:2F5C63F427A5DEDD5BF2B3867BE4C13774E9276C1472BF4170BCB2DA462B848CC8088743D032765133EE138388DF4217E4FC1475B12D2C8AF657A45ED6FEDE93
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Iqaluit) {.. {-9223372036854775808 0 0 -00}.. {-865296000 -14400 0 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-147898800 -10800 1 EDDT}.. {-131569200 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}.. {483519600 -14400 1 EDT}.. {499240800 -18000 0 EST}.. {514969200 -14400 1 EDT}.. {530690400 -18000 0 EST}.. {544604400 -14400 1 EDT}.. {562140000 -18000 0 EST}.. {576054000 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607503600 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638953200 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671007600 -14400 1 EDT}.. {688543200 -18000 0 EST}.. {7024

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Jamaica

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):847
                                                                          Entropy (8bit):4.206296468996689
                                                                          Encrypted:false
                                                                          SSDEEP:24:5seRvZGjFS/uk1p/uue/udYR/u+zN5hi/uW9/uoUF0/u8Bb/u33RU/uMZ8/unuR3:5jUjFo1pFGzfAYFqB43RMER3
                                                                          MD5:95B59E3EA2A270A34BDF98AA899203C8
                                                                          SHA1:93599597797F4BAFE5C75179FB795058B1E3527D
                                                                          SHA-256:4B9D5177CBA057CD53D53120A49B8A47ECCB00150018581A84851E9D5437D643
                                                                          SHA-512:032BC07F9E92B756A0732AECC2DFEC4C89A58B3D6D3CA57A0F99F2AD1D51676804C7B6CE50EB3B37BB8A1EF382168AC83989D609D37C57308E29B51F1FDEFB1E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Jamaica) {.. {-9223372036854775808 -18430 0 LMT}.. {-2524503170 -18430 0 KMT}.. {-1827687170 -18000 0 EST}.. {126248400 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {441781200 -18000 0 EST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Jujuy

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):211
                                                                          Entropy (8bit):4.94277888588308
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7/MI6HAIgp/MIwRN/290pPGe90/MIz:MByMY/Myp/M9Rt290h390/M4
                                                                          MD5:E020D4F9CB1AF91D373CD9F3C2247428
                                                                          SHA1:0ADF2E9F8D9F8641E066764BA1BAF068F0332CE9
                                                                          SHA-256:4A0495852CD4D0652B82FB57024645916DB8F192EEF9A82AFD580D87F4D496ED
                                                                          SHA-512:03190F0E7EC35A358670B1617CB5C17EA3DD41195B2C4B748479D80ABAB4DB395293F688D94B87662D0469F6C5885CF7E7C9A995493A191905753F740DF659E1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Jujuy)]} {.. LoadTimeZoneFile America/Argentina/Jujuy..}..set TZData(:America/Jujuy) $TZData(:America/Argentina/Jujuy)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Juneau

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8682
                                                                          Entropy (8bit):3.9620285142779728
                                                                          Encrypted:false
                                                                          SSDEEP:96:/fCG0rHPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:/aG0rq9DiaJCUbPI+D/iMpCIBSuk
                                                                          MD5:8160A0D27EECEF40F6F34A06D5D02BE6
                                                                          SHA1:7CAA64F83BAA0C23EE05A72BB1079AA552FA2F3D
                                                                          SHA-256:5FBE6A1FA2D3DFE23C7378E425F32BEBCA44735DA25EA075A7E5CE24BFD4049D
                                                                          SHA-512:59B8D04595007B45E582E6D17734999074CA67A93F5DF742EFE1EB78DB8ABD359D4C3B213B678C6A46040A13AAB709A994B6A532D720D3EF6FCA2730ABF4885E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Juneau) {.. {-9223372036854775808 54139 0 LMT}.. {-3225223727 -32261 0 LMT}.. {-2188954939 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {309949

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Kentucky\Louisville

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9553
                                                                          Entropy (8bit):3.853353361425414
                                                                          Encrypted:false
                                                                          SSDEEP:96:tfTwKdrdJ9+StCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:tfUKNdJ9+SItON0HY2iUmUFLqU
                                                                          MD5:D721B38F1FFF1A6F5C02B72ECC06CDE5
                                                                          SHA1:E70D99A9FC1DA9F30389129EE00FE20FA79D66A8
                                                                          SHA-256:9EB1F2B19C44A55D6CC9FD1465BAF6535856941C067831E4B5E0494665014BF5
                                                                          SHA-512:3C82A8C27026228F359FD96A4306F1BC337DE655FD1BA02C4399162E44DE59AD58CE569DA5AEA36E586C3BDEE7256420AABB84B44D277E244FE5AD771B4BE307
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Kentucky/Louisville) {.. {-9223372036854775808 -20582 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1546279200 -21600 0 CST}.. {-1535904000 -18000 1 CDT}.. {-1525280400 -21600 0 CST}.. {-905097600 -18000 1 CDT}.. {-891795600 -21600 0 CST}.. {-883591200 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747251940 -18000 1 CDT}.. {-744224400 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Kentucky\Monticello

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8558
                                                                          Entropy (8bit):3.869494272122571
                                                                          Encrypted:false
                                                                          SSDEEP:96:4F8qMahLi8hR1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:4F8HaUqJN0HY2iUmUFLqU
                                                                          MD5:AED6497590DA305D16AC034979C8B1E9
                                                                          SHA1:AD6F1788310A3A5A761873FEF1A32416B7DBCA89
                                                                          SHA-256:1C6C7FB0AE628EB6BB305B51859C4E5594A6B0876C386ED9C1C3355E7CB37AE1
                                                                          SHA-512:58D960AB5F2D9F8E4DD0171E5E36CE2E072F74A7AFDBC43F9340BBCF0CDC0D060AC895F9FCF551F4CC7EB6DBF2E9835C8C3D58E87CA4FBC98C720F51C462EDCD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Kentucky/Monticello) {.. {-9223372036854775808 -20364 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-63136800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Knox_IN

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):4.8670778268802195
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y73GKaHAIgp3GKIN/2901iZ903GKT:MByMY3GKDp3GKIt290Q903GKT
                                                                          MD5:50434016470AC512A8E2BEBA0BCEBC15
                                                                          SHA1:F3541F6EE201FA33C66042F5C11A26434D37D42C
                                                                          SHA-256:D66E77E6FF789D4D6CA13CDB204B977E1FE64BE9AFEE7B41F2C17ED8217FD025
                                                                          SHA-512:EB1FF97050B7E067DCB68FF7C8F912C8A0C02144BB8E2EAA58C1136C6CC4A2B98C897DD23BB1E9C82D9AF6D028EE45227F97676CB34B6B830CDF5D707B990E57
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Knox)]} {.. LoadTimeZoneFile America/Indiana/Knox..}..set TZData(:America/Knox_IN) $TZData(:America/Indiana/Knox)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Kralendijk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):4.9362668992592456
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2901Qv090ppv:MByMYbpwt290ev090b
                                                                          MD5:FE9CEC6C50DF451B599B98AE8A434FF7
                                                                          SHA1:60F997825766662B2C5415FBE4D65CEA6D326537
                                                                          SHA-256:5AF9B28C48661FDC81762D249B716BA077F0A40ECF431D34A893BB7EABA57965
                                                                          SHA-512:1311605021871BAFAF321AA48B352262C6BA42149101CCD4FDD4000435B2584AC564E0F76D481BB181767C010FD922BAA4E4EBB401AC2FF27B21874D89332872
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Kralendijk) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\La_Paz

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):218
                                                                          Entropy (8bit):4.902526230255025
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/290WDm2OHphvoHvKZdcyFXmBVVON:MB86290ymdHphvCvKfcyy/ON
                                                                          MD5:3BC04900A19D0152A31B353C6715A97B
                                                                          SHA1:58A6D49E0B6FA00CBEAFD695D604D740AD63C54E
                                                                          SHA-256:5488D98AA3C29D710C6AF92C42ACE36550A5BFF78C155CDF8769EE31F71CF033
                                                                          SHA-512:65302935090F98A81443A1E1158911F57C3A1564564CD401CA72DDBF66D967DB564EF5AE8A4083D83984B9EF55AB53159010EFE2DB5D7A723F7EA61A1795322D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/La_Paz) {.. {-9223372036854775808 -16356 0 LMT}.. {-2524505244 -16356 0 CMT}.. {-1205954844 -12756 1 BST}.. {-1192307244 -14400 0 -04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Lima

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):460
                                                                          Entropy (8bit):4.2444415392593875
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290B2mdH4VCvvCOt/Os/OCQXR/uFfC3/O3e/uFbs/OX/OqF/O+8/OOS1F5/D:59etvqOVLOR/uGD/utsg38xSP5r
                                                                          MD5:5F41E848D2DDE91261F45CB577B1B0A9
                                                                          SHA1:DF284499CF57479ADE5E1D3DC01D6DCCF6AFDFE1
                                                                          SHA-256:6E01002F264DF9A6FC247F95399F4F42DCCC7AB890B0C259DE93DCC97DEC89CE
                                                                          SHA-512:2F5472F812734E892182632B8A34A4AD7B342541D0C3F1107BD95FFBE25D9351A0CDF5F58F35A1F37365DDF8A8A5D883C89C3CC40A9AD09D54CA152DC6BE1A09
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Lima) {.. {-9223372036854775808 -18492 0 LMT}.. {-2524503108 -18516 0 LMT}.. {-1938538284 -14400 0 -05}.. {-1002052800 -18000 0 -05}.. {-986756400 -14400 1 -05}.. {-971035200 -18000 0 -05}.. {-955306800 -14400 1 -05}.. {-939585600 -18000 0 -05}.. {512712000 -18000 0 -05}.. {544248000 -18000 0 -05}.. {638942400 -18000 0 -05}.. {765172800 -18000 0 -05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Los_Angeles

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9726
                                                                          Entropy (8bit):3.8515163794355916
                                                                          Encrypted:false
                                                                          SSDEEP:192:/uX68CWSgG0U9bFzN6IkWq/WHQt/RY4yP:/uX68CWSgGVbGBt/M
                                                                          MD5:4D4F198238E4E76753411896239041C3
                                                                          SHA1:AD41D199DF0B794B5AB7F165C8A141787FAAC9A9
                                                                          SHA-256:DA3F7572F04E6AE78B8F044761E6F48D37EE259A9C1FE15A67072CC64A299FDB
                                                                          SHA-512:BA39D174B73B1D4B09E8AC07291BED0B9658A4330AE50881080F0E37C35BD8A6F55C49F1D649ED1F19CE47002435D8724048759DFC813BF9C2E9B06B581486FF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Los_Angeles) {.. {-9223372036854775808 -28378 0 LMT}.. {-2717640000 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-687967140 -25200 1 PDT}.. {-662655600 -28800 0 PST}.. {-620838000 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589388400 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557938800 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526489200 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Louisville

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):228
                                                                          Entropy (8bit):4.911677030377383
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y71PiKp4o2HAIgp1PiKp4BvN/290hp4901PiKp44v:MByMYPyApPydt290P490Pyi
                                                                          MD5:ACE87B25FE5604C83127A9F148A34C8C
                                                                          SHA1:25C8D85B4740C53F40421D0DADCA95225EAB7829
                                                                          SHA-256:F85C1253F4C1D3E85757D3DEA4FD3C61F1AA7BE6BAAE8CB8579278412905ACB2
                                                                          SHA-512:AC0662B19F336474B146E06778E1FB43B941ABC8FD51BDB31B2640C94CCDFBE7659960EF4FD18329AFA7AD11316FC08D3CF33BB27931EA70AA7218667A8D0737
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Kentucky/Louisville)]} {.. LoadTimeZoneFile America/Kentucky/Louisville..}..set TZData(:America/Louisville) $TZData(:America/Kentucky/Louisville)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Lower_Princes

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):207
                                                                          Entropy (8bit):4.900350318979456
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290h48h490ppv:MByMYbpwt290/490b
                                                                          MD5:83CE86174ADB5F276AABD26FE132BB55
                                                                          SHA1:925E3F4A5DB1A2C33B3A537C8DBC9CFE309FA340
                                                                          SHA-256:1E786229B84CE86DB6316B24C85F7CF4CFE66011F973053AD0E108BFCC9A9DE2
                                                                          SHA-512:BA2AC5571D772B577735BC8E43FF8023228BC61A974DCCE0EAE20EC9B11FC757E56CABDAE00933A99834108114E598B7EC149BB017EB80BE18301A655F341A36
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Lower_Princes) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Maceio

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1539
                                                                          Entropy (8bit):3.7453889877550512
                                                                          Encrypted:false
                                                                          SSDEEP:48:5QChlvEw6kSSx5H4a8tf3fkuoLdNYVZDNR8nd:OIlvEwJSSxdF8tfMuoLdNYVZJR8nd
                                                                          MD5:EB0EDF4E075E3CF9F8EDF2B689C2FE54
                                                                          SHA1:9713D7E8AA0E7164824657D00DE6C49483D2BD19
                                                                          SHA-256:F65C5957D434A87324AAD35991E7666E426A20C40432540D9A3CB1EEE9141761
                                                                          SHA-512:0A0D1E4E0BD7D854E8F139E6F7A9BBC66422B73F7A6C2E1F1B6D2CA400B24B3D220AB519B6AEAA743443E9A4B748709CDF2C276BF52C5382669B12734A469125
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Maceio) {.. {-9223372036854775808 -8572 0 LMT}.. {-1767217028 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Managua

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):611
                                                                          Entropy (8bit):4.303621439025158
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290znTjmdHOYCvprv5EU/dLAyW+/uF+kX8/uF+RZ//dAWcP/QAWcx/uF+rbE:5GnPeOdvhxD1pLS+S8S+RVqzo4xS+3SJ
                                                                          MD5:FB09D1F064C30F9E223FA119A8875098
                                                                          SHA1:C66173FEB21761AEA649301D77FBB77ACF3A6FB1
                                                                          SHA-256:F0F0CCE8DE92D848A62B56EF48E01D763B80153C077230C435D464CF1733BA38
                                                                          SHA-512:BC3D841FF48FD0DE7C9ABF5DAE3A42C876BD4D7FBD6684B4513EC7ECC92D938A7133BCC873AD46E453DD1863E843E5C7DD14FFDB41B593E90BEB5CD8F7E66202
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Managua) {.. {-9223372036854775808 -20708 0 LMT}.. {-2524500892 -20712 0 MMT}.. {-1121105688 -21600 0 CST}.. {105084000 -18000 0 EST}.. {161758800 -21600 0 CST}.. {290584800 -18000 1 CDT}.. {299134800 -21600 0 CST}.. {322034400 -18000 1 CDT}.. {330584400 -21600 0 CST}.. {694260000 -18000 0 EST}.. {717310800 -21600 0 CST}.. {725868000 -18000 0 EST}.. {852094800 -21600 0 CST}.. {1113112800 -18000 1 CDT}.. {1128229200 -21600 0 CST}.. {1146384000 -18000 1 CDT}.. {1159682400 -21600 0 CST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Manaus

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1166
                                                                          Entropy (8bit):3.7842934576858482
                                                                          Encrypted:false
                                                                          SSDEEP:24:5GnqeKwnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQz:5mSeSFESoSQSrSsCSeSPS1cSQSQlSsSQ
                                                                          MD5:E42719A9B0165490BB9E0E899EFB3643
                                                                          SHA1:2991D7EC31F47E32D2C8DB89A0F87D814122DD1B
                                                                          SHA-256:DC54E6D4FE14458B0462FA0E15B960FD4290930ADC0D13453BF49B436ED8C143
                                                                          SHA-512:F75024E27A2D679A667EA70EC948F983C7B823FDA5962DD88697D61147A6C2B1499E58BA8B01170653C4D025900491AE8E21925500DE39EACBAF883F7E62D874
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Manaus) {.. {-9223372036854775808 -14404 0 LMT}.. {-1767211196 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200 -1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Marigot

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):201
                                                                          Entropy (8bit):4.900738604616686
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290zzJ/90ppv:MByMYbpwt290zzN90b
                                                                          MD5:8C60DE8E522FE5D51EACD643FD8EA132
                                                                          SHA1:2E09A71DF340ECA6F7AEBD978070D56A627049EC
                                                                          SHA-256:5C26D7CE93F91CC4F5ED87E9388B1B180EF9D84681044FD23CC01A628A1284CA
                                                                          SHA-512:D2D522D041AFA638542F6FF00F5F40325E3F117C5035BA71F676B4956B054542C67A753055D17E2E2EEA925F13EACC0969D01EC18E40D274D8EA408F92777EA2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Marigot) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Martinique

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):251
                                                                          Entropy (8bit):4.849143012086458
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/290zlEDm2OHfueoHv9dMIqR5lRfT/VVFUFkmR/lAov:MB86290zimdHfnCv9dMIqR5lVb/uFkmD
                                                                          MD5:CFE10EE56115D3A5F44E047B3661D8ED
                                                                          SHA1:03F598CFC9AEDE2F588339B439B2361F2EBDE34F
                                                                          SHA-256:D411FB42798E93B106275EC0E054F8F3C4E9FB49431C656448739C7F20C46EDE
                                                                          SHA-512:25D6760FDF2F1B0DD91A41D29BDB7048FAE27A03F7B9D9C955ECF4C32E8402836D007B39FE62B93E7BEA017681A0C8AFC1C4CAFD823B0A6C41EDAF09DDF3435D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Martinique) {.. {-9223372036854775808 -14660 0 LMT}.. {-2524506940 -14660 0 FFMT}.. {-1851537340 -14400 0 AST}.. {323841600 -10800 1 ADT}.. {338958000 -14400 0 AST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Matamoros

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6745
                                                                          Entropy (8bit):3.842851851460931
                                                                          Encrypted:false
                                                                          SSDEEP:96:nD5NA604qSScBgN+4ctDzIVQ/c/3hNxTh:nDbA604qSBgI7DBch
                                                                          MD5:2CE5A1AA4D5AEC9B94FA980FAA0222AB
                                                                          SHA1:40838538813002C9E69F8FD244E77D4C22CF654F
                                                                          SHA-256:6738B94878D0CF4D88206858ABA03D18B0A2DE71D8F051B7D19C2C367DD59D79
                                                                          SHA-512:C6097A3EEDB0E68F3FE9E97816AF76631D0239EF843DEBA87096D8DB6B0E9787FA3820062871A9B22F58833B7B36F51F25B738AD671A21665BE49EAD71CC17F6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Matamoros) {.. {-9223372036854775808 -24000 0 LMT}.. {-1514743200 -21600 0 CST}.. {568015200 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {599637600 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Mazatlan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6841
                                                                          Entropy (8bit):3.872535525478649
                                                                          Encrypted:false
                                                                          SSDEEP:96:WNG1GK5+yBEzg4GaaECHm3FL5TInckNSNi:/5+yBEzVWEaOkv
                                                                          MD5:CBCB4A9A77EE76C16C8EC9DDD3231ABC
                                                                          SHA1:270B2C3C8F5A2EFD47E4DFA22521E36CEFD5A774
                                                                          SHA-256:F1E4E853758A3D79013D5B24AE45FDFD41A7C110949A5C5DB96CF14B479FA741
                                                                          SHA-512:F64FFDA679E360E50C95DFA45CE866E51DC87B440E984CCABDD57E2C1C3F2FAD44256AE44FAA84E0F577B22CD1A80F891E14BF811D6D83ADA9B19DE32692175F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Mazatlan) {.. {-9223372036854775808 -25540 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -2520

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Mendoza

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):219
                                                                          Entropy (8bit):4.812188311941308
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7/MeHAIgp/MSvYovN/290zpH+90/MX:MByMY/M/p/MSA6t290zpe90/MX
                                                                          MD5:2A3BFEEFBB684FB3B420A6B53B588BDC
                                                                          SHA1:CC5C0BB90D847CCBB45688A8DA460AD575D64617
                                                                          SHA-256:D6B308A1619F2DE450DACBFEF0E11B237DF7375A80C90899DD02B827688CB4B8
                                                                          SHA-512:4A35C80D3454E039383FFEB06DC84933B3201BE2487C42A448AF3DA5ABAEEB9882263C011CDD3194E121EC1C31FC80120BF7829F280A79996E376CFA828EE215
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Mendoza)]} {.. LoadTimeZoneFile America/Argentina/Mendoza..}..set TZData(:America/Mendoza) $TZData(:America/Argentina/Mendoza)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Menominee

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8410
                                                                          Entropy (8bit):3.8311875423131534
                                                                          Encrypted:false
                                                                          SSDEEP:96:6quShLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:6lSUqtfA604qSBgI7DBch
                                                                          MD5:C74D31382279219F805D2B138C58FBF7
                                                                          SHA1:06E2FED0A3BDF62F3D390A4054B6A2D7C1863DD3
                                                                          SHA-256:B0863F8B66F0848020651B69E7997307D62209259AE653FDC1A0FAFC8E793068
                                                                          SHA-512:7B42CBDC119651E2B2EE8B8F934801D3147A8B72EE060A0D0EA1C0C12CA9ABD03F1A102A85BF8E7424B45620151CE107D16A9173F4AA7597EDB3109840C1B2AE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Menominee) {.. {-9223372036854775808 -21027 0 LMT}.. {-2659759773 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-116438400 -18000 1 CDT}.. {-100112400 -21600 0 CST}.. {-21484800 -18000 0 EST}.. {104914800 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200 -18000 1 CDT}.. {278492400 -21600 0 CST}.. {294220800 -18000 1 CDT}.. {309942000 -2160

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Merida

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6651
                                                                          Entropy (8bit):3.8421369120684714
                                                                          Encrypted:false
                                                                          SSDEEP:48:5bu36fELf0On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAqy6:1qehpYtpjyrz7nKED4KPddGEYA/Gx
                                                                          MD5:BEA04423DB05D122622807857EFD2B36
                                                                          SHA1:EE2A2AB89DFFFE2880801E8667AF2AD627E641EC
                                                                          SHA-256:2B4FACFC69A195C646842A8B47AFE76D755CEEDAD536DEE7ECE79302BAF97223
                                                                          SHA-512:D860332F4A50F886600E9DCF3F0ACA6CC6FAD1421ECCAF0E67D0CB76F5FBFA1DC0F243F0B312A3CFB0614BD76C6A76C45E5C6F582073B23FEC4B72E77950E2EC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Merida) {.. {-9223372036854775808 -21508 0 LMT}.. {-1514743200 -21600 0 CST}.. {377935200 -18000 0 EST}.. {407653200 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0 CST}.. {1207468800 -18000 1 CDT}.. {1225004400 -21600 0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Metlakatla

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6705
                                                                          Entropy (8bit):3.985641709481311
                                                                          Encrypted:false
                                                                          SSDEEP:96:4DCG0haiaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:42G0IiaJCUbPI+D/iMpCIBSuk
                                                                          MD5:4999FE49C1640402CB432BC1EB667479
                                                                          SHA1:2ED0044927A66856090793ED6E5FF634617C8C40
                                                                          SHA-256:2574831391092AD44D7B2806EEF30D59CE3BAE872111917DD39EC51EFDD62E5F
                                                                          SHA-512:39DE1D24037F3FFA3101BBAA885939074E596479F68013CDA9CE53A061EA704F63FB55C15B68B66B0E29E3F07ADC0BDC2D78A2D289277E75D2EF95F54988DB74
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Metlakatla) {.. {-9223372036854775808 54822 0 LMT}.. {-3225223727 -31578 0 LMT}.. {-2188955622 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {30

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Mexico_City

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7035
                                                                          Entropy (8bit):3.8457960083650584
                                                                          Encrypted:false
                                                                          SSDEEP:48:5CBU/UI+n36fELf5On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10B:EBNqehpYtpjyrz7nKED4KPddGEYA/Gx
                                                                          MD5:8688CD1F2C071314E56666D70DAD8261
                                                                          SHA1:32F9C882D148BB9568F719099B3DCE25B53FB43C
                                                                          SHA-256:3458EAF721C1CDF565B5ADDB487B4F1B93FA46744E9E5FC91D74787173B233A4
                                                                          SHA-512:02A110943B2458DA20BC6D2568B19819B4831DAAD6968EC9D1A523DD81D5499AB21630F865C9CF70AEBE54D39CE72A0F833B91492E694F3117E32E06432F30DB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Mexico_City) {.. {-9223372036854775808 -23796 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-975261600 -18000 1 CDT}.. {-963169200 -21600 0 CST}.. {-917114400 -18000 1 CDT}.. {-907354800 -21600 0 CST}.. {-821901600 -18000 1 CWT}.. {-810068400 -21600 0 CST}.. {-627501600 -18000 1 CDT}.. {-612990000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001836800 -21600 0 CST}.. {1014184800 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {10357020

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Miquelon

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7080
                                                                          Entropy (8bit):3.5379714312244217
                                                                          Encrypted:false
                                                                          SSDEEP:192:2UViR+iORv7bw1aW5AnMyxH5e+fHbxMfOp6D7bF8qMmqyiqV1mjZe7JhlgXY7FWN:02l5qJZS
                                                                          MD5:C68889AA813C399939FCFA54E9CE0DFB
                                                                          SHA1:F3D58D7BEFF2D1CB94FECE00C31FEF5BDF58C231
                                                                          SHA-256:1B131AC968F95652667BD7EB1F6D667C8F679B31270D82B4B4271E787386CCCA
                                                                          SHA-512:EBAF8210919E34668E9DDFCB546E5A62F35954957AAE956B6302BF296C7D4CF51E1B10FB13217CB3EEB430DAC246217EB4E9250CB4109C95D8A4367457D02771
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Miquelon) {.. {-9223372036854775808 -13480 0 LMT}.. {-1850328920 -14400 0 AST}.. {326001600 -10800 0 -03}.. {536468400 -10800 0 -02}.. {544597200 -7200 1 -02}.. {562132800 -10800 0 -02}.. {576046800 -7200 1 -02}.. {594187200 -10800 0 -02}.. {607496400 -7200 1 -02}.. {625636800 -10800 0 -02}.. {638946000 -7200 1 -02}.. {657086400 -10800 0 -02}.. {671000400 -7200 1 -02}.. {688536000 -10800 0 -02}.. {702450000 -7200 1 -02}.. {719985600 -10800 0 -02}.. {733899600 -7200 1 -02}.. {752040000 -10800 0 -02}.. {765349200 -7200 1 -02}.. {783489600 -10800 0 -02}.. {796798800 -7200 1 -02}.. {814939200 -10800 0 -02}.. {828853200 -7200 1 -02}.. {846388800 -10800 0 -02}.. {860302800 -7200 1 -02}.. {877838400 -10800 0 -02}.. {891752400 -7200 1 -02}.. {909288000 -10800 0 -02}.. {923202000 -7200 1 -02}.. {941342400 -10800 0 -02}.. {954651600 -7200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Moncton

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):10507
                                                                          Entropy (8bit):3.8204583916930557
                                                                          Encrypted:false
                                                                          SSDEEP:192:X9+FPHyXFRsivcQYM+T7Z/xVQzxmtBWIXrObx29x8sLxcGMe++wzlrfFjxKvnpNM:gF6L0d0F2TzNc/1cYUH+CC
                                                                          MD5:80B88F57B837CD2478815796618A6AC6
                                                                          SHA1:CC2BE0213E9F0D3B307A8311D7A1013582E8A338
                                                                          SHA-256:D977D045DE5CDAEB41189B91963E03EF845CA4B45E496649B4CB541EE1B5DD22
                                                                          SHA-512:9410CBD706CAABFFF88DFF75235597D844B45A061EBD796F6708D7CEAB680273571A17935B7CCFC7C466ABF293C286D0886F47880E692F74C4E8BFB41729C73C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Moncton) {.. {-9223372036854775808 -15548 0 LMT}.. {-2715882052 -18000 0 EST}.. {-2131642800 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-1167595200 -14400 0 AST}.. {-1153681200 -10800 1 ADT}.. {-1145822400 -14400 0 AST}.. {-1122231600 -10800 1 ADT}.. {-1114372800 -14400 0 AST}.. {-1090782000 -10800 1 ADT}.. {-1082923200 -14400 0 AST}.. {-1059332400 -10800 1 ADT}.. {-1051473600 -14400 0 AST}.. {-1027882800 -10800 1 ADT}.. {-1020024000 -14400 0 AST}.. {-996433200 -10800 1 ADT}.. {-988574400 -14400 0 AST}.. {-965674800 -10800 1 ADT}.. {-955396800 -14400 0 AST}.. {-934743600 -10800 1 ADT}.. {-923947200 -14400 0 AST}.. {-904503600 -10800 1 ADT}.. {-891892800 -14400 0 AST}.. {-883598400 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-757368000 -14400 0 AST

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Monterrey

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6714
                                                                          Entropy (8bit):3.843663571428462
                                                                          Encrypted:false
                                                                          SSDEEP:48:5JZKy36fELf0On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAO:XwDqehpYtpjyrz7nKED4KPddGEYA/Gx
                                                                          MD5:7BAF644224F6045B791D64A3AA41B515
                                                                          SHA1:FCB940F91B8A7AE599433460C27953890FA38F27
                                                                          SHA-256:63813975BC90A2AE8A6500D7A3173A3C81C060F8B5AAA3E86D5FDC4D5F06ABD8
                                                                          SHA-512:F2DD85E8F1875274A6ACD3B9F90869ABA0539CFD564DC7DEA490AE3B7DC66B83D6F76EC3F1389FD3DFC111E5A198B7AB9AEE54CCE9A3B9C6871BE0DB211FEB76
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Monterrey) {.. {-9223372036854775808 -24076 0 LMT}.. {-1514743200 -21600 0 CST}.. {568015200 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {599637600 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Montevideo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2936
                                                                          Entropy (8bit):3.6410670126139046
                                                                          Encrypted:false
                                                                          SSDEEP:48:5JgQkS4SaEcSyS0sZSUS2kSVSXSulSASX5kAXJMsCXrUari3akaWCa3M+lafpI6L:X5kH4c9GT0E01jm5keJMRXrUEi3akaWO
                                                                          MD5:D78DEBC7C0B15B31635DDC34C49248BC
                                                                          SHA1:DB2FF76DB3A79BE52E2DFD4C7B8B6592946772F9
                                                                          SHA-256:214F97A3BCB2378CCE23D280EA6A3B691604F82E383628F666BE585BB8494932
                                                                          SHA-512:E5FCD0B54F61910E70B1D0EE9911C5B4AFF850F16B651A01D69A63A97880913B0BAB99B0D864C4E613594734FA72CCA0E9607B1ADB6E75957C790990114FD0A4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Montevideo) {.. {-9223372036854775808 -13491 0 LMT}.. {-1942690509 -13491 0 MMT}.. {-1567455309 -14400 0 -04}.. {-1459627200 -10800 0 -0330}.. {-1443819600 -12600 0 -0330}.. {-1428006600 -10800 1 -0330}.. {-1412283600 -12600 0 -0330}.. {-1396470600 -10800 1 -0330}.. {-1380747600 -12600 0 -0330}.. {-1141590600 -10800 1 -0330}.. {-1128286800 -12600 0 -0330}.. {-1110141000 -10800 1 -0330}.. {-1096837200 -12600 0 -0330}.. {-1078691400 -10800 1 -0330}.. {-1065387600 -12600 0 -0330}.. {-1047241800 -10800 1 -0330}.. {-1033938000 -12600 0 -0330}.. {-1015187400 -10800 1 -0330}.. {-1002488400 -12600 0 -0330}.. {-983737800 -10800 1 -0330}.. {-971038800 -12600 0 -0330}.. {-954707400 -10800 1 -0330}.. {-938984400 -12600 0 -0330}.. {-920838600 -10800 1 -0330}.. {-907534800 -12600 0 -0330}.. {-896819400 -10800 1 -0330}.. {-853621200 -9000 0 -03}.. {-84

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Montreal

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.748877320903638
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEzQ21h4IAcH:SlSWB9vsM3y7RQtHAIgpRQPN/290zQgp
                                                                          MD5:9130CD86BD6417DB877BF9D8F3080CE1
                                                                          SHA1:76C37982C37FE54ED539AC14B5A513817E42937C
                                                                          SHA-256:97F48948EF5108FE1F42D548EA47C88D4B51BF1896EE92634C7ED55555B06DBD
                                                                          SHA-512:EE036350AF95414392BD93DFF528F67D9A93EB192A30056ECBC3D2396AB4B2938B3C096C3EC2BC739294D4C4B7261C427B0AAEB9559F5381CB7F375892781820
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Montreal) $TZData(:America/Toronto)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Montserrat

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):4.878534808314885
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290zQ1HK90ppv:MByMYbpwt290zQ490b
                                                                          MD5:CB5988A2508285B42C2BD487B8F9D6E1
                                                                          SHA1:EAD740A566245B682CE5E284D389DFAE66DF05D9
                                                                          SHA-256:6C3EE46983A3DAA91C9ADF4B18D6B4B80F1505B0057569B66D5B465D4C09B9C1
                                                                          SHA-512:48796213A67F0E3BC56B54CE4D8BE098E74BA5808C9A1082D9381CB729ADFA2ACB9CE9E39A3244B3901405761C97AEE28D44C3BF7239ECC71175C62E152029C4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Montserrat) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Nassau

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.785765433607229
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEwEzEeIAcGu:SlSWB9vsM3y7RQtHAIgpRQPN/290xzEf
                                                                          MD5:F7DAD684104D917E0F29F6951EA627AC
                                                                          SHA1:E57B5CA730D90C5865CF32FEC4872F71E033D21C
                                                                          SHA-256:A889810B8BB42CD206D8F8961164AD03CCFBB1924D583075489F78AFA10EAF67
                                                                          SHA-512:8284F2A357A32B2F5A211904F65E3B5C37B77C9BF38C85DFA0A95A73457F3076EC12F09BC767B4D0B8FC86BF69D01A17A7BF685BAB72F3E519A397D050DA0C3B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Nassau) $TZData(:America/Toronto)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\New_York

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):11373
                                                                          Entropy (8bit):3.8110553140357086
                                                                          Encrypted:false
                                                                          SSDEEP:96:HeohzORhK1a8phYvNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:+uORhK1a8phYloSItON0HY2iUmUFLqU
                                                                          MD5:385C3BDD3E41E5E75CEF0658322B5CDE
                                                                          SHA1:0334C21C8316ED2EE16FC98B1E8867D5E0916C00
                                                                          SHA-256:7BA7DA179AA7DF26AC25E7ACCD9BD83784174445285A0D9CCBD7D6A9AA34F4BC
                                                                          SHA-512:764B680FB8414B5AC8FB110247C19B1004A4453DD2BAC94BF3CFD80281FF3679A5B1D212238509165E022269503ED14A54B0EF73AF7014344752E6A627657D1F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/New_York) {.. {-9223372036854775808 -17762 0 LMT}.. {-2717650800 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-1577905200 -18000 0 EST}.. {-1570381200 -14400 1 EDT}.. {-1551636000 -18000 0 EST}.. {-1536512400 -14400 1 EDT}.. {-1523210400 -18000 0 EST}.. {-1504458000 -14400 1 EDT}.. {-1491760800 -18000 0 EST}.. {-1473008400 -14400 1 EDT}.. {-1459706400 -18000 0 EST}.. {-1441558800 -14400 1 EDT}.. {-1428256800 -18000 0 EST}.. {-1410109200 -14400 1 EDT}.. {-1396807200 -18000 0 EST}.. {-1378659600 -14400 1 EDT}.. {-1365357600 -18000 0 EST}.. {-1347210000 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-123895440

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Nipigon

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8100
                                                                          Entropy (8bit):3.8314265228376105
                                                                          Encrypted:false
                                                                          SSDEEP:96:xhZ8gEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:xAgEItON0HY2iUmUFLqU
                                                                          MD5:54722EA33AAC411AA1D51D5E00423937
                                                                          SHA1:C6D1E5EAC6A72CCE738E465C8AA32CC76FD1DDC7
                                                                          SHA-256:BB4BA3C15C626F6F94AC026A7C3D5DFE3854B17CBFA3F540FFAFFD9D5B491083
                                                                          SHA-512:E66F7C2AEFB483526A7F11292B4F5E9C972DB12BAEF42110A45C49DCA5EA1DA2482A9FACA223D9F543F5ABE92CC54311ADA1852332DB184AE49CCFCED8D9405C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nipigon) {.. {-9223372036854775808 -21184 0 LMT}.. {-2366734016 -18000 0 EST}.. {-1632070800 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-923252400 -14400 1 EDT}.. {-880218000 -14400 0 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {136364400 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {167814000 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Nome

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8680
                                                                          Entropy (8bit):3.965662913874442
                                                                          Encrypted:false
                                                                          SSDEEP:96:OrBvOs5vzC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:OrBvOsM9DiaJCUbPI+D/iMpCIBSuk
                                                                          MD5:9A5F536932FED5A93E2C3DEB81960CD1
                                                                          SHA1:8E78396D280DD3A9564CEFC7FB722437F3C4D003
                                                                          SHA-256:8E971C9560CCE548B46626D072E62AB0F4C9682BF6A6ABFB4D0E8D63745402FE
                                                                          SHA-512:60CFDBCE87F9CD7F27E071D66B97E60F62E56F413DC867BC809490B30D00045D0757710D6B5724148E2A28BD1E45FB662391820E6350D998002BF67B16776645
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nome) {.. {-9223372036854775808 46702 0 LMT}.. {-3225223727 -39698 0 LMT}.. {-2188947502 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Noronha

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1397
                                                                          Entropy (8bit):3.78056049136398
                                                                          Encrypted:false
                                                                          SSDEEP:24:5TenykFxCFbF3YCFE2FBCFDFr9CFaFPBCFoF2CFTFKCFDuF1CF2F1CFWFhCFGF3a:5quY9EmFYBosNZNW/bWsBzgCccq7JYN9
                                                                          MD5:B4F4530FCE4BF5690042A2DA40413D56
                                                                          SHA1:52D5F2102485F5B326C888A287ED83CA18833BBC
                                                                          SHA-256:9011C76295E6B17CC1973876B497BEE21B9E6562FB25DF66140F811A1FFA9765
                                                                          SHA-512:08CAF75226D190D9FF0AA62AD84B13F1BF9047338A690847DF5B448BDB731A877F3E186298AFD704F4F4E133FF3F3128B098F9D90AE9A8E726AE52F84A7DA2E3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Noronha) {.. {-9223372036854775808 -7780 0 LMT}.. {-1767217820 -7200 0 -02}.. {-1206961200 -3600 1 -02}.. {-1191366000 -7200 0 -02}.. {-1175378400 -3600 1 -02}.. {-1159830000 -7200 0 -02}.. {-633823200 -3600 1 -02}.. {-622072800 -7200 0 -02}.. {-602287200 -3600 1 -02}.. {-591836400 -7200 0 -02}.. {-570751200 -3600 1 -02}.. {-560214000 -7200 0 -02}.. {-539128800 -3600 1 -02}.. {-531356400 -7200 0 -02}.. {-191368800 -3600 1 -02}.. {-184201200 -7200 0 -02}.. {-155167200 -3600 1 -02}.. {-150073200 -7200 0 -02}.. {-128901600 -3600 1 -02}.. {-121129200 -7200 0 -02}.. {-99957600 -3600 1 -02}.. {-89593200 -7200 0 -02}.. {-68421600 -3600 1 -02}.. {-57970800 -7200 0 -02}.. {499744800 -3600 1 -02}.. {511232400 -7200 0 -02}.. {530589600 -3600 1 -02}.. {540262800 -7200 0 -02}.. {562125600 -3600 1 -02}.. {571194000 -7200 0 -02}.. {592970400 -

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\North_Dakota\Beulah

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8557
                                                                          Entropy (8bit):3.8810445182855253
                                                                          Encrypted:false
                                                                          SSDEEP:96:WEktwmGaLV911sF9A604qSScBgN+4ctDzIVQ/c/3hNxTh:WBwDPPA604qSBgI7DBch
                                                                          MD5:10AF9E9461DD03DA4F0AF0595EB36E6C
                                                                          SHA1:57AC9BDE3AC665E49D9D2463A4BFA38C053A4A54
                                                                          SHA-256:D0D8B108453265B60F525A4EC04DE9555087CD6AC5DDBA980B3A96CF0FCD68D1
                                                                          SHA-512:B6DC7D2709A19B911E086C988DB8346F42DBF7601D9E51E3093C6AF897570E43E5F1C101FE88BC5251F3DCC3B532DB22FFE8A12A4D0151BC52AF3E6DDEA7D23A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/Beulah) {.. {-9223372036854775808 -24427 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\North_Dakota\Center

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8557
                                                                          Entropy (8bit):3.867423227197841
                                                                          Encrypted:false
                                                                          SSDEEP:96:ZEktwmGaLV9tZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:ZBwD6fA604qSBgI7DBch
                                                                          MD5:33C03AD65753D7ADB45FC4899B504D1A
                                                                          SHA1:ED719BB67A64DB49901BA38A945A6BA998646B8D
                                                                          SHA-256:ABC2B6C97D9E9FBA37AC582ADBA2CE996890D090060E083405D75CDAED9EABE0
                                                                          SHA-512:69592E8A370C8A5173827500CDDF8190AB44EA87CD7E0C416055CB7958B13A737801EA6B0FFE6032CB3F14F05001BF9DA83E4AEB20F385019B2985ECE7ACB40E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/Center) {.. {-9223372036854775808 -24312 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\North_Dakota\New_Salem

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8560
                                                                          Entropy (8bit):3.879452555978431
                                                                          Encrypted:false
                                                                          SSDEEP:96:GEktwmGaLV9nlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:GBwD2fA604qSBgI7DBch
                                                                          MD5:3D3DC12209293086FD843738A4FE87FB
                                                                          SHA1:8103DFA18B5F3F36AF0B53FA350E0F2D300E6289
                                                                          SHA-256:8803FF7C81C933B57178B9D3C502FB4268D9AA594A3C638A7F17AF60B12D300D
                                                                          SHA-512:39BB939780A71B817F82D2B7F56815D33926D150525161051A9950E5A98BA9184670AFC884A1C69D56EADBD6198E3082975448EFBA5FE8A336DB071E6BAB8EF2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/New_Salem) {.. {-9223372036854775808 -24339 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -2160

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Nuuk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7429
                                                                          Entropy (8bit):3.5470060859729253
                                                                          Encrypted:false
                                                                          SSDEEP:192:0ixKXpbzvZ+FxAqe12voJ0euJFNgIHc/QEeF5Z1V8tCSfifK3facfzQWWLQelXuC:0LRJq9LstgV
                                                                          MD5:FC9CEA4B9654D0957F55CB0E1B25A3E7
                                                                          SHA1:8BFC3E8CEC34C4087579D3DA727143E3EC045B77
                                                                          SHA-256:12917DAAA60134BFE56E6979BB27B58A3F295C32BAE02B233E849BCED6B8BCA2
                                                                          SHA-512:355628F2EFF86605653A1EE7D976CE8B3229A4169D35576F6007FABAB37DD280D8F296EE88BECE3D84D3A1C476F23275D1D77CAF157E9A98672CBF14801D7292
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nuuk) {.. {-9223372036854775808 -12416 0 LMT}.. {-1686083584 -10800 0 -03}.. {323845200 -7200 0 -02}.. {338950800 -10800 0 -03}.. {354675600 -7200 1 -02}.. {370400400 -10800 0 -03}.. {386125200 -7200 1 -02}.. {401850000 -10800 0 -03}.. {417574800 -7200 1 -02}.. {433299600 -10800 0 -03}.. {449024400 -7200 1 -02}.. {465354000 -10800 0 -03}.. {481078800 -7200 1 -02}.. {496803600 -10800 0 -03}.. {512528400 -7200 1 -02}.. {528253200 -10800 0 -03}.. {543978000 -7200 1 -02}.. {559702800 -10800 0 -03}.. {575427600 -7200 1 -02}.. {591152400 -10800 0 -03}.. {606877200 -7200 1 -02}.. {622602000 -10800 0 -03}.. {638326800 -7200 1 -02}.. {654656400 -10800 0 -03}.. {670381200 -7200 1 -02}.. {686106000 -10800 0 -03}.. {701830800 -7200 1 -02}.. {717555600 -10800 0 -03}.. {733280400 -7200 1 -02}.. {749005200 -10800 0 -03}.. {764730000 -7200 1 -0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Ojinaga

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6843
                                                                          Entropy (8bit):3.877923791759769
                                                                          Encrypted:false
                                                                          SSDEEP:48:5gUq33FS1YluOQiLvf3PCeq5r3xod8CzSP2IZ5Sy4DLbrc6HiviVN:So1c7Lv/PCewtA8CzSPyDLbrcUia
                                                                          MD5:32BDE9C2C59F2A34D3B9F98BC9894A99
                                                                          SHA1:04A24DC4A3C2A0D7C9C8E0001E320662778A78BF
                                                                          SHA-256:549E92BDEC98D21C5C4A996F954671A2F0262463415BF294D122500246309BC4
                                                                          SHA-512:A33E583EC5B2B274C4247C109F37F9A4495ED9094849F6A8E68145EBF6A1906B3DD0B31BB7690261FEDA9C72F2288F4D1121365F544B9EC1343E208B472D0660
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Ojinaga) {.. {-9223372036854775808 -25060 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {820476000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {883634400 -21600 0 CST}.. {891766800 -21600 0 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -25200 0 MST}.. {1143968400 -21

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Panama

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.970379147398626
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2IAcGEu5YfMXGm2OHGf8xYoHv5BidhZvFsc1HRX1va0v:SlSWB9eg/290ZDm2OHDxYoHv5GhZd93p
                                                                          MD5:AA408A43079EC8933DE271BE3DA2B502
                                                                          SHA1:421A867DB3FD4779C5F759D0B657D8EB5FB2218B
                                                                          SHA-256:990213DDE00ADCEB74C8D1ECAF81B9C77963E4AB1F35767F7349236FC8E917DF
                                                                          SHA-512:1FB740527555A8E128E05709D05720A249BCBA4B6434D00226C07426E6283AA48973F75268F36E6044F0F0650E012781C8E5519B7EA916C625BBF018B29E9961
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Panama) {.. {-9223372036854775808 -19088 0 LMT}.. {-2524502512 -19176 0 CMT}.. {-1946918424 -18000 0 EST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Pangnirtung

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7736
                                                                          Entropy (8bit):3.8533019559841972
                                                                          Encrypted:false
                                                                          SSDEEP:192:tTqPm4bPJWXtRbALtuO/N0HY2iUmUFLqU:Izod
                                                                          MD5:6BA298F9CEB6406802A01C13313F8EF1
                                                                          SHA1:D77C113CFA927EF65461781FD080F590C8CFCBB9
                                                                          SHA-256:1FB962ECC1E5F02E1001C70460FFF720B114554F9AA7956D6DA154DBEA87B4D7
                                                                          SHA-512:C7F4E2DA503A3167098CFAB7AEC8D75A32D6B081E6777DE7BA3D6B4558D0C44D2CD8A0F1626968295031BABFD2CB96B031B4C00A44F2C554B5B217AE67E69EB4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Pangnirtung) {.. {-9223372036854775808 0 0 -00}.. {-1546300800 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-147902400 -7200 1 ADDT}.. {-131572800 -14400 0 AST}.. {325663200 -10800 1 ADT}.. {341384400 -14400 0 AST}.. {357112800 -10800 1 ADT}.. {372834000 -14400 0 AST}.. {388562400 -10800 1 ADT}.. {404888400 -14400 0 AST}.. {420012000 -10800 1 ADT}.. {436338000 -14400 0 AST}.. {452066400 -10800 1 ADT}.. {467787600 -14400 0 AST}.. {483516000 -10800 1 ADT}.. {499237200 -14400 0 AST}.. {514965600 -10800 1 ADT}.. {530686800 -14400 0 AST}.. {544600800 -10800 1 ADT}.. {562136400 -14400 0 AST}.. {576050400 -10800 1 ADT}.. {594190800 -14400 0 AST}.. {607500000 -10800 1 ADT}.. {625640400 -14400 0 AST}.. {638949600 -10800 1 ADT}.. {657090000 -14400 0 AST}.. {671004000 -10800 1 ADT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Paramaribo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):253
                                                                          Entropy (8bit):4.784405839512086
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/290olofDm2OHekeoHXFIV/1Vw/9vVOzFZg/VVFAKV:MB86290oloLmdHeVCXqV/k/9v4zW/OW
                                                                          MD5:BFCE7E2618D6935031D6941AD6DDD8E3
                                                                          SHA1:1953CD224FB2363B10372C0476760F3FB020CB00
                                                                          SHA-256:B3EE44B3526BEDFC25B806371D3C465FDBD6CC647F30BF093750651E4A0C1BE4
                                                                          SHA-512:31262DF034E084DA4CDB57B99178594C29129F61F3535E5D8245B8BB4AB6BF314307B0F5E58B74C349684CD761C9CDE44EB10407FB135BA6427D3D1E9DA99B40
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Paramaribo) {.. {-9223372036854775808 -13240 0 LMT}.. {-1861906760 -13252 0 PMT}.. {-1104524348 -13236 0 PMT}.. {-765317964 -12600 0 -0330}.. {465449400 -10800 0 -03}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Phoenix

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):496
                                                                          Entropy (8bit):4.444598497301421
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290OXmdH514YCvb8o1W4S9xRvhhHRVxORBYUNv:5tekdvYP1x52yq
                                                                          MD5:062ECA57C0B795780240CD7AFE70BDA0
                                                                          SHA1:89D71A11DD8D4E000F7FADBDDC77C4C1DC1195F7
                                                                          SHA-256:DFA0EC91804B789A1A7E1B1977710435D2589A5B54C1579C8E1F5BF96D2FD007
                                                                          SHA-512:7D123AA872E0B8286A26E338AE0F8E0D7A6F0F2EA8B1EBEC6DBB59477C812985CB246AD397D0901A58FDB7FF14171CF60169DC15C538B95C58BD2D46106A7A4D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Phoenix) {.. {-9223372036854775808 -26898 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-820519140 -25200 0 MST}.. {-796841940 -25200 0 MST}.. {-94669200 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-56221200 -25200 0 MST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Port-au-Prince

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6613
                                                                          Entropy (8bit):3.8549788442269395
                                                                          Encrypted:false
                                                                          SSDEEP:48:5Ux+E2p3T6ZqrNSMEBPMcywh4NF5zCC7IOTWa1HW1241UWK9BDL+3XC4BMrS2LxP:KOfS0HY2iU7KKdFL6Aa2K4gSLf8e
                                                                          MD5:A720323DF122C70C1530788DB24700BA
                                                                          SHA1:20674BD7D84CC686ABBB5D6B36B520A5E9C813ED
                                                                          SHA-256:A89C580899AD2FF8DF45A783BB90D501DC32C28B92931CA18ABD13453E76244B
                                                                          SHA-512:02B71E537B9FDAF1B68E381F0007CCBBA53EB70719ED38F51B56C5BFA64C7E3D9797053C9DE3A920E5CAFA09BBC062FCED62B5D6B9213AFA8286B95DEDAB0532
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Port-au-Prince) {.. {-9223372036854775808 -17360 0 LMT}.. {-2524504240 -17340 0 PPMT}.. {-1670483460 -18000 0 EST}.. {421218000 -14400 1 EDT}.. {436334400 -18000 0 EST}.. {452062800 -14400 1 EDT}.. {467784000 -18000 0 EST}.. {483512400 -14400 1 EDT}.. {499233600 -18000 0 EST}.. {514962000 -14400 1 EDT}.. {530683200 -18000 0 EST}.. {546411600 -14400 1 EDT}.. {562132800 -18000 0 EST}.. {576050400 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607500000 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638949600 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671004000 -14400 1 EDT}.. {688543200 -18000 0 EST}.. {702453600 -14400 1 EDT}.. {719992800 -18000 0 EST}.. {733903200 -14400 1 EDT}.. {752047200 -18000 0 EST}.. {765352800 -14400 1 EDT}.. {783496800 -18000 0 EST}.. {796802400 -14400 1 EDT}.. {814946400 -18000 0 EST}.. {828856800 -14400 1 EDT}

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Port_of_Spain

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):207
                                                                          Entropy (8bit):4.919510214047913
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290e7490ppv:MByMYbpwt290190b
                                                                          MD5:4AB394CB233B101627136EB5E070CF9B
                                                                          SHA1:F00600CD2DB10FE157C3696F665B9759EEA85F99
                                                                          SHA-256:A4952380C89A6903FFE5BF8707B94B1BB72568FFD03DB04BF4D98E38AC82EEB7
                                                                          SHA-512:58F4AD08FA10F1884FA641C4EA778C0FC013EABBD68DF5DE04D5B301227396260C3D669DB33DD6A6B33F1550C24BBD7777D756DF0D61CEEAF5EC6541EDFA296C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Port_of_Spain) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Porto_Acre

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):201
                                                                          Entropy (8bit):4.866417687745155
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7thteSHAIgpth9RN/290msh490th4:MByMYdIp7t290v490I
                                                                          MD5:6B570E79FA2AA7D6CB1E56A11EE0A37C
                                                                          SHA1:396A2C9BBE4F264DD5A4F2E44D3E63C57F52186B
                                                                          SHA-256:52921EEA2A1925DF06CEA4638ED4128FAAA8FBA40ED4E0741650B419E5152DCB
                                                                          SHA-512:FA75A179664BED02A0F5BC1B7C3DD5F3E986544A151634BA4C4401476F5999714C89E240D9AF805484D1BEC04A1A562157FAEECA1603C4FF8CFFB424B9DEB560
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:America/Porto_Acre) $TZData(:America/Rio_Branco)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Porto_Velho

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1051
                                                                          Entropy (8bit):3.851275104153641
                                                                          Encrypted:false
                                                                          SSDEEP:24:5Xe4QJnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/8:5kSeSFESoSQSrSsCSeSPS1cSQSQlSsSX
                                                                          MD5:03046BA6F8344C32AD7A22748DC871AB
                                                                          SHA1:AB9ED078D80AE99EF6DE4BF34AC45359B82D1284
                                                                          SHA-256:E6E6F6753E7D443052A64D4DB07B8D443CE13A573946E7D0A19CDD4BBA4A2F04
                                                                          SHA-512:620953BB4C8CF203262EC0C1F807543D24B9894C3B531AE57F7CEF630452CC9AC7CA41D43A6D8891F9CF17594E9EE34CF501F8508E7C0669A8E5EF9C70B6EAA3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Porto_Velho) {.. {-9223372036854775808 -15336 0 LMT}.. {-1767210264 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {5712012

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Puerto_Rico

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):283
                                                                          Entropy (8bit):4.781646667761219
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/290piDm2OH9VoHvMlFoeVVF70ZVVFUFkzk/lLJpR/lAov:MB862908mdHvCvMlGe/J0Z/uFkzk/lL1
                                                                          MD5:E2E2E0D6677FFF2E37BBFC3522F2A9AA
                                                                          SHA1:4C1C93E14FBC00B8B1E78B8D9631599164305EB1
                                                                          SHA-256:2981248A9F14EBFC8791EC5453170376CBD549557E495EA0E331CC18556C958E
                                                                          SHA-512:F056B03EB9945823F5284C840E06E298DD2DE854F1555CD16D0BB19D962B73EF34A05683E6369B0D89CB7C3F7D082C312CCA6F8C6A0BB53F5C75FE4A863FCD95
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Puerto_Rico) {.. {-9223372036854775808 -15865 0 LMT}.. {-2233035335 -14400 0 AST}.. {-873057600 -10800 0 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-757368000 -14400 0 AST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Punta_Arenas

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3698
                                                                          Entropy (8bit):3.6242875066986078
                                                                          Encrypted:false
                                                                          SSDEEP:96:22SW+xUQjzoMUBI0nuUoDKlHslPlgiot7JC/Xk8NWse4r4g5xCEmSdLkUsZOn+ZW:28+xUQjzoMUBI0nuUoDK6lPlgiot7JCV
                                                                          MD5:11B8DD9FB854C62D7692EDD2445C6F90
                                                                          SHA1:51F2ABF95D73CA21674D1AA1C5F50501F76A7F3D
                                                                          SHA-256:22418567D55A0E38CAB005665271D9279A384856FDF0CE5A9AEABDCD66CCBC72
                                                                          SHA-512:B657DE13FF71268ABA1790AED7D60CC1DA867434CE78421AD023BDECCC5E1BA9863952029E07FB577B57A3247FA9157B2C0AA9F894658B3F032CC36DDE701887
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Punta_Arenas) {.. {-9223372036854775808 -17020 0 LMT}.. {-2524504580 -16966 0 SMT}.. {-1892661434 -18000 0 -05}.. {-1688410800 -16966 0 SMT}.. {-1619205434 -14400 0 -04}.. {-1593806400 -16966 0 SMT}.. {-1335986234 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}.. {37767600 -14400 0 -04}.. {55915200 -10800 1 -04}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Rainy_River

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8104
                                                                          Entropy (8bit):3.8351355650290304
                                                                          Encrypted:false
                                                                          SSDEEP:96:InJkLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:IJ3qtfA604qSBgI7DBch
                                                                          MD5:98E0F428A3773CE6FF0CEBF2F88EA81A
                                                                          SHA1:3DFA7D21A31C99078A139C5F41740B8EAD4085C2
                                                                          SHA-256:B1630FA919D652F30D23253E1C561BB76FB4D28844A2F614D08B0A25B17CFB27
                                                                          SHA-512:11C8E1F15B3FDC36DAD12229038BE10DA231872F804BD9FFF1786192541C4ABAFB27099C24EC3122F92A0D94D7D4A6E1ACD0A05845EC614982176A859B74E9FF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rainy_River) {.. {-9223372036854775808 -22696 0 LMT}.. {-2366732504 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-923248800 -18000 1 CDT}.. {-880214400 -18000 0 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {136368000 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {167817600 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200 -18000 1 CDT}.. {278492400 -21600 0 CST}.. {294220800 -18000 1 CDT}.. {309942000 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CS

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Rankin_Inlet

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7614
                                                                          Entropy (8bit):3.8349162993762267
                                                                          Encrypted:false
                                                                          SSDEEP:96:Wi8h4ZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:bqOfA604qSBgI7DBch
                                                                          MD5:793DAEDB7E3077DE52DCC3C8A7CBEC5B
                                                                          SHA1:37562E9F28D51DED41FFD5FF2FF19E2E4E453B7A
                                                                          SHA-256:AA8866D58BEAB07548180628FF423887BBF48AADB1B55392B288F7310F94A9B1
                                                                          SHA-512:68A32B41DC2D3E730D6BE53656B0D566AB1BCC1E189A2FFDB5687A947EF4F4008BC17456F8CE0D59C838EEA87A44400231A44E6AB35BEDBF5D7779E1CD7EFD8A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rankin_Inlet) {.. {-9223372036854775808 0 0 -00}.. {-410227200 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {7

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Recife

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1420
                                                                          Entropy (8bit):3.78262494063765
                                                                          Encrypted:false
                                                                          SSDEEP:24:5aLexyGcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaI1kR8nd:5eTChlvEw6kSSx5H4a8tf3fkuoYVZDm+
                                                                          MD5:4D12651CEE804EB9F29567CB37F12031
                                                                          SHA1:54B2613475B8BDB1DBCCA53A4895DA021F66BDC0
                                                                          SHA-256:A36AD4614FC9A2A433712B555156EDE03980B88EB91D8DC7E8B10451D6D7F7D3
                                                                          SHA-512:E6690F6B6DF613C8B7289A2DB71FBC9B87B997707A6C3B4B45BDE8F347082AE8C69F212BAACE50F3C04E325ABE0976AF1F61107BDF8A15D5B88F11FAE11A9D00
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Recife) {.. {-9223372036854775808 -8376 0 LMT}.. {-1767217224 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Regina

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1781
                                                                          Entropy (8bit):4.034282439637634
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290hjmdHfCv24Q1NAvHaE+YB+Q4kRcMxIeRUVX/SEQd1rRR9xRv0+Ro/wPjp:5EjeavTGOtAVvSRBpx0yq1epwD+yz+
                                                                          MD5:14B29B4391B643E5707096ADCC33C57E
                                                                          SHA1:B3F875ABB79C634C74307B7CB7B276B13AEE11D1
                                                                          SHA-256:50105E788288CF4C680B29BBDCDE94D8713A5361B38C6C469FD97CF05503FF7D
                                                                          SHA-512:D92A51547DF2C1AB6E6CDEFF34C07B755D3F6BB5E7DD1907693E7658EDE4D2BADC5DEFDB658ADD0F8D8F14B3B87CEA17BC00DAC364C5CB7ACBF8778C245276A9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Regina) {.. {-9223372036854775808 -25116 0 LMT}.. {-2030202084 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1251651600 -21600 1 MDT}.. {-1238349600 -25200 0 MST}.. {-1220202000 -21600 1 MDT}.. {-1206900000 -25200 0 MST}.. {-1188752400 -21600 1 MDT}.. {-1175450400 -25200 0 MST}.. {-1156698000 -21600 1 MDT}.. {-1144000800 -25200 0 MST}.. {-1125248400 -21600 1 MDT}.. {-1111946400 -25200 0 MST}.. {-1032714000 -21600 1 MDT}.. {-1016992800 -25200 0 MST}.. {-1001264400 -21600 1 MDT}.. {-986148000 -25200 0 MST}.. {-969814800 -21600 1 MDT}.. {-954093600 -25200 0 MST}.. {-937760400 -21600 1 MDT}.. {-922039200 -25200 0 MST}.. {-906310800 -21600 1 MDT}.. {-890589600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-748450800 -21600 1 MDT}.. {-732729600 -25200 0 MST

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Resolute

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7610
                                                                          Entropy (8bit):3.8312000314798085
                                                                          Encrypted:false
                                                                          SSDEEP:96:li8h4Z80NA604qSScBgN+4ctDzIVQ/c/3hNxTh:EqOzA604qSBgI7DBch
                                                                          MD5:541EACD872723603971058CB205121D7
                                                                          SHA1:8F7DFD5ECA2913846D9342839AE1C60882153DA0
                                                                          SHA-256:643CC43E3F906779C040E1F0C20E78D6E95CC7301B3C7370A8ADBCBD76A8C5E8
                                                                          SHA-512:971D06D3FB67B7AE79EEDB6D3EBB805B5992C2BF4A7166016B405E21BFB25D9A87A757E8065073D5FBEB9084F6F742269A5BF432BF2F03D30913DB092E1AB3A1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Resolute) {.. {-9223372036854775808 0 0 -00}.. {-704937600 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {73391

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Rio_Branco

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1112
                                                                          Entropy (8bit):3.8413073465060457
                                                                          Encrypted:false
                                                                          SSDEEP:24:5Ybe/k5Yss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6Gs:505YsMw57XJh4CxUF/A6GTrtSUDwr
                                                                          MD5:7E23FDE0E158E8ED2E7536EDE70D2588
                                                                          SHA1:319052BE076DC79F130E807D68B11CCAA0636340
                                                                          SHA-256:28082D20872B61D6098D31D1C40F12464A946A933CD9AF74475C5AF384210890
                                                                          SHA-512:BE078ED12F05AB5CEE5D77212EB76A01A1BC52EEAA17E3B91D93B88D75E5281B6AF164E712A9AB0F57A21B3CDB20F6FCCADB73CAC4745B5D2E665D18F9F06B55
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rio_Branco) {.. {-9223372036854775808 -16272 0 LMT}.. {-1767209328 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {57120480

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Rosario

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):219
                                                                          Entropy (8bit):4.801485647578614
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7/MSHAIgp/M1ovN/290rI5290/M7:MByMY/M7p/M16t290r190/M7
                                                                          MD5:90830F3B1F91FE48AC2944C7C92A3F6E
                                                                          SHA1:777377AE4959DDD2B472EB6041A23A5B93D64BB6
                                                                          SHA-256:0117D33D4F326AA536162D36A02439FBD5F2EB3B4F540B5BA91ED7747DDAC180
                                                                          SHA-512:20A371E4550E402AFEB83EF19EFFF6B3C0D7A68DCAA06AD894D04DB63B7096560E701C45B455B23A98BB20FE3B590F920219152415CA506AEDA427BB1381B826
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Santa_Isabel

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):194
                                                                          Entropy (8bit):4.869058214823402
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7ekHAIgpeON/290tX2U490eBn:MByMYMpJt290c90m
                                                                          MD5:F4E62378AA05771D348AA6DA516CD386
                                                                          SHA1:07FCA813693F7944CBCBB128F2F2FE32929D37A2
                                                                          SHA-256:3B4C2F3A5B9CD22A73F05187C032723D07BB53C9946D04D35E1BA1CB90CA0A62
                                                                          SHA-512:E9F6CEB824D656CA25A72BF8EB4347A22E1A8E40410F01E0C2EDE19ACAF32D76540399796B3EBC7781C8B5D48C1A6B2C856CA06158AE37D95C95CF0567DFA2E5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Santa_Isabel) $TZData(:America/Tijuana)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Santarem

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1079
                                                                          Entropy (8bit):3.8200568741699223
                                                                          Encrypted:false
                                                                          SSDEEP:24:5zeUdunSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/h:52SeSFESoSQSrSsCSeSPS1cSQSQlSsSU
                                                                          MD5:7F2658032008F2C1308F121C2EBF2479
                                                                          SHA1:B6F24E818B4424C0DEF818C103D1DA5359958932
                                                                          SHA-256:4A397BD937DE1D7E6A941D18001B34D4CD195AEFD08951C30C7EE8E48656AA0E
                                                                          SHA-512:F78853AA75F58A85555DD79E08A7487E5161854650DBF480189790D855738FEDCBDA936870067DE40FE000861008A9E9AAF61DF02B6B30B96038C61B5E1F1C1D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santarem) {.. {-9223372036854775808 -13128 0 LMT}.. {-1767212472 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Santiago

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8871
                                                                          Entropy (8bit):3.5333393351633897
                                                                          Encrypted:false
                                                                          SSDEEP:192:5Gv/IxUQjzoMUBI0nuUoDK6lPlgiot7JC/k8NWse4r4g5xCEmMQUs8nCxvisEbzQ:5Aa9TzDCjg32+E
                                                                          MD5:0659C7482FC6121AF4714DA6E2188069
                                                                          SHA1:79D8B13C54AEDE9EDC191EB92F8CD6BE936490F4
                                                                          SHA-256:B2D7FD4DB34800C9EF9BD73CDDB1105543CCED05F3E2AC99F3E5E2F6CF340AE2
                                                                          SHA-512:C138C580648D7EAAB22828EA4318F6FAEEF618B994C2E05AF23ACF03A279506053C85BFDBC03B9E32B1CA5826713D7FFC249CE33B3F0EA734A2E4CE626AAB3A3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santiago) {.. {-9223372036854775808 -16966 0 LMT}.. {-2524504634 -16966 0 SMT}.. {-1892661434 -18000 0 -05}.. {-1688410800 -16966 0 SMT}.. {-1619205434 -14400 0 -04}.. {-1593806400 -16966 0 SMT}.. {-1335986234 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-740520000 -10800 1 -03}.. {-736376400 -14400 0 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Santo_Domingo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):616
                                                                          Entropy (8bit):4.330655351784895
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290/StmdHhvCvuCY/h/uFkS/5MVvMrW//MVvMrpx/m0XVvMr4UB/47VvMr/d:5+seQvuCY5/u/REfk+xxdbUBQpu652GO
                                                                          MD5:FAD0621010889164ADC4472003C9391F
                                                                          SHA1:C4EE0B8D6925338D17D5745DE9D45FA3C628DFC5
                                                                          SHA-256:2217E72B11A90F2D679C175DE3CC0F2FED4C280C9FF9707CFFAF118BF9A06A4B
                                                                          SHA-512:90E8E5A109CD72458C7796CF0324F63E543CCD63D13A09A3DD28EDC8B2793C964C18E79FDF0C5067C5A481B7FB03E8413139C32F59DA07E9D7893378ABBBD2B3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santo_Domingo) {.. {-9223372036854775808 -16776 0 LMT}.. {-2524504824 -16800 0 SDMT}.. {-1159773600 -18000 0 EST}.. {-100119600 -14400 1 EDT}.. {-89668800 -18000 0 EST}.. {-5770800 -16200 1 -0430}.. {4422600 -18000 0 EST}.. {25678800 -16200 1 -0430}.. {33193800 -18000 0 EST}.. {57733200 -16200 1 -0430}.. {64816200 -18000 0 EST}.. {89182800 -16200 1 -0430}.. {96438600 -18000 0 EST}.. {120632400 -16200 1 -0430}.. {127974600 -18000 0 EST}.. {152082000 -14400 0 AST}.. {975823200 -14400 0 AST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Sao_Paulo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2900
                                                                          Entropy (8bit):3.6548008349990755
                                                                          Encrypted:false
                                                                          SSDEEP:48:5uFChlvEwR9xSSx5H4a8tf3fku+da2XUd23t8VZDG8+w/ghBPWTRz908a9zRgwun:cFIlvEwZSSxdF8tfMu+da2kdCt8VZy8n
                                                                          MD5:F6B732A862659EB131C2E6FEC00E9734
                                                                          SHA1:49517DF63BC5B6FEC875CE9477BBF84F4072FA31
                                                                          SHA-256:0E7BA1C5A3FA3DABDAA226BFE1E8D797A3835EA554828881AB5E365EDA09B92E
                                                                          SHA-512:670A5B604B5EA0F5FA15083BC1EA115B7EFD449F9EAC4518E109493591893DD3627AFC6628E0EDD1953E932E2A7AD9B5A379526548677158EC445366E4ED7166
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sao_Paulo) {.. {-9223372036854775808 -11188 0 LMT}.. {-1767214412 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-195429600 -7200 1 -02}.. {-189381600 -7200 0 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Scoresbysund

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6839
                                                                          Entropy (8bit):3.565857684485945
                                                                          Encrypted:false
                                                                          SSDEEP:192:9OgtbdF7TI7nYUYXg9W/OAcv7vuShytWi0PnvLrqPoKR2XszXckXtogYN4Ezlk0X:PJr9Q7TMq+ML
                                                                          MD5:D1BF579FE8123E8EE9248A51E794CC78
                                                                          SHA1:BF9CB9BED143C7529719E0C1E2F88BE1AC9F8DD4
                                                                          SHA-256:158BD9E4EB0B9DFF3F2D3E2DBA72F217B73423012DD33A688FD57852124E884A
                                                                          SHA-512:78192AC38912021F848592D0B208CB122EFFC6DDB326540FFAADA4FD3322B7A442FD1116F408D64B8788520B46545DFAE571EA42046D62A282A97ECCD5663655
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Scoresbysund) {.. {-9223372036854775808 -5272 0 LMT}.. {-1686090728 -7200 0 -02}.. {323841600 -3600 0 -01}.. {338961600 -7200 0 -02}.. {354679200 0 0 +00}.. {370400400 -3600 0 -01}.. {386125200 0 1 +00}.. {401850000 -3600 0 -01}.. {417574800 0 1 +00}.. {433299600 -3600 0 -01}.. {449024400 0 1 +00}.. {465354000 -3600 0 -01}.. {481078800 0 1 +00}.. {496803600 -3600 0 -01}.. {512528400 0 1 +00}.. {528253200 -3600 0 -01}.. {543978000 0 1 +00}.. {559702800 -3600 0 -01}.. {575427600 0 1 +00}.. {591152400 -3600 0 -01}.. {606877200 0 1 +00}.. {622602000 -3600 0 -01}.. {638326800 0 1 +00}.. {654656400 -3600 0 -01}.. {670381200 0 1 +00}.. {686106000 -3600 0 -01}.. {701830800 0 1 +00}.. {717555600 -3600 0 -01}.. {733280400 0 1 +00}.. {749005200 -3600 0 -01}.. {764730000 0 1 +00}.. {780454800 -3600 0 -01}.. {796179600 0 1 +00}.. {8

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Shiprock

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):187
                                                                          Entropy (8bit):4.888573146674231
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/2IAcGEtOFBx+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/290tO09Z
                                                                          MD5:2FF74846ADF32AA3A9418376775B7F25
                                                                          SHA1:130D7548DFFEBCE74969962E335B40299D7C5C54
                                                                          SHA-256:BF4FAB3AE72CC7FA4F9E34CF0551A85C54A084CD826DF5D9CC684DE6188E84DB
                                                                          SHA-512:9E52C017E595EEF1C68C8A1943416A9109D7DB4C32D25F83D05213C4200869A50E2E726894E39ECA364C558BB7F5566F6150CEA5D3CB14D1DEAE28C3D8C810E0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:America/Shiprock) $TZData(:America/Denver)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Sitka

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8651
                                                                          Entropy (8bit):3.959337076866423
                                                                          Encrypted:false
                                                                          SSDEEP:96:IGCG0hPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:I5G0A9DiaJCUbPI+D/iMpCIBSuk
                                                                          MD5:7CCB6902749079A0496F1E2E2137448E
                                                                          SHA1:3D0ED7BF1C26659F6794E26AE3869F8AB925B6DF
                                                                          SHA-256:ABB08435CAE80119068A85984BFFE9C1596F4FB90F07CC01124C907E5162C189
                                                                          SHA-512:0B5B2DCECC70F357DB6D590AB63E600C572EA6B3F430565EFEB29777B1901AAC55CACC7495C668F739201076B180402141BC1B2ED2357E9B4DFBABF3B122AB44
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sitka) {.. {-9223372036854775808 53927 0 LMT}.. {-3225223727 -32473 0 LMT}.. {-2188954727 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {3099492

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\St_Barthelemy

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):207
                                                                          Entropy (8bit):4.932842207797733
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290txP90ppv:MByMYbpwt2907P90b
                                                                          MD5:CBFA61DBF6F7459CF8D517402B29998E
                                                                          SHA1:A562B29C9470DBD25480966B0462433124BA4164
                                                                          SHA-256:353CDBD46BA8C7472A93E9E800A69105801F6784B22EC50A59294CDC3BE40E18
                                                                          SHA-512:00B333EAA2C32EDDA8F06457AD0E10013A0147B20F504F4F1096656F731A7C1896D5ABD83E7EDBD5D4E7DA587EE9BFA796539EB1E9F4056D75D1FDF203251150
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Barthelemy) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\St_Johns

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):11289
                                                                          Entropy (8bit):3.8713946894934614
                                                                          Encrypted:false
                                                                          SSDEEP:192:PmxVjd1cO8f7/EjUhSicN6zvfwb+8YbTE0M0J:PmrcOI7/EjiskY01J
                                                                          MD5:8F068899DA75663128320633E1881333
                                                                          SHA1:E9161B45D7B11A2DD6E9679AC080E84EC51561E3
                                                                          SHA-256:E2917204B0C843C32051BB371CF6D0AD272C02720B9C0D913AC072C8ABE1EC64
                                                                          SHA-512:2200E9B9D816157330ADAEA7383635876E5A37329B1AF9613D38BCFBE8143835837A25132A94E44A61DB8058ED98B1A33F295EA64BC1F4CE30966D52BB0B673D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/St_Johns) {.. {-9223372036854775808 -12652 0 LMT}.. {-2713897748 -12652 0 NST}.. {-1664130548 -9052 1 NDT}.. {-1650137348 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1598650148 -9052 1 NDT}.. {-1590100148 -12652 0 NST}.. {-1567286948 -9052 1 NDT}.. {-1551565748 -12652 0 NST}.. {-1535837348 -9052 1 NDT}.. {-1520116148 -12652 0 NST}.. {-1503782948 -9052 1 NDT}.. {-1488666548 -12652 0 NST}.. {-1472333348 -9052 1 NDT}.. {-1457216948 -12652 0 NST}.. {-1440883748 -9052 1 NDT}.. {-1425767348 -12652 0 NST}.. {-1409434148 -9052 1 NDT}.. {-1394317748 -12652 0 NST}.. {-1377984548 -9052 1 NDT}.. {-1362263348 -12652 0 NST}.. {-1346534948 -9052 1 NDT}.. {-1330813748 -12652 0 NST}.. {-1314480548 -9052 1 NDT}.. {-1299364148 -12652 0 NST}.. {-1283030948 -9052 1 ND

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\St_Kitts

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):202
                                                                          Entropy (8bit):4.907031043022691
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tMp490ppv:MByMYbpwt290g490b
                                                                          MD5:D521F2D9B28C5374FC3BD540C6B6F40D
                                                                          SHA1:39A3D86CB71F742F33B02F50B316638815B3CD4E
                                                                          SHA-256:EDB9457A7C64E47062BDC6458FD3BCFCD6C37820F1A2BC89DFE99ED77355011F
                                                                          SHA-512:05C1BE92550A962904ED3BB7DECCAC16FCB54D258F24F2AEDF755FCC44E4FEF5F86AB663945809F5D7AFA64178E807BBDAE77048270ED516DFF2C7720A746D52
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Kitts) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\St_Lucia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):202
                                                                          Entropy (8bit):4.9037013606484905
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tY90ppv:MByMYbpwt290a90b
                                                                          MD5:9392E5A7BD198B0308F9271E4C7E59B2
                                                                          SHA1:A902440920A0318BC930957C74804A9A51EF7818
                                                                          SHA-256:6727A509BB937CB3446D41B57826DE70C7028E96F088AB5B7F803BEAA18279E8
                                                                          SHA-512:6DA1EAC390E72905DF1A14D82362B499D20FAD6D85F3DF116AE01E566D5D19C6D16E56DA72C458BB6143345EF45F35A53B245488C641D80BFBA200B16A59719E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Lucia) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\St_Thomas

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):203
                                                                          Entropy (8bit):4.919272465019375
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tXIMFJ490ppv:MByMYbpwt290tJ490b
                                                                          MD5:49D0C8DAFCA053C9967EDCC4C0A484B1
                                                                          SHA1:7B4999D4B9AD93306BD411DF2946D741EC597770
                                                                          SHA-256:974AEED3D79124B50265C83D84F23CBE4F0328D00C75F42DD3ABC5D4C0A78DE1
                                                                          SHA-512:378E3657B26C5A039FF82ECCAC7797FF45CBC6479596629B3048164EE4E035F4ECFC557AA9EAF6848E78999B4FF8C63E53C7163BDF6F626ED6111004490D6F80
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Thomas) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\St_Vincent

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):4.909053768717241
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tzb+Q90ppv:MByMYbpwt290xyQ90b
                                                                          MD5:6CFB23E7164605CDE380FB7C4D88DF11
                                                                          SHA1:CC513B29AD7B59E600DBCBC97927EB632558F657
                                                                          SHA-256:6B19404D295964EF66F47802836BB728FCE8E6481115797C0B5F200C354D7C8A
                                                                          SHA-512:728987D0925B6E12E8A220920BEDF94180880E78F3F08F6AC740E6304B22D446846068CEA499F61E7032ADB2E700CE31954921D478C9A8B6CB599E05A6292EA3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Vincent) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Swift_Current

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):874
                                                                          Entropy (8bit):4.253846650171654
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86290hEbmdHLCvYX4Q19xRv0+RmwPj+uLkQOzL3+ORL4FXgenM7RSslKA1PyKp:5zeOvT4xuyqoYaAxt7l
                                                                          MD5:C91F801CC5E9F78B966D1DF2259C38A8
                                                                          SHA1:D29C970CBFC74684D46AAAD543B73B520775632C
                                                                          SHA-256:939B25C9412B9E25D73F552E87826999FC8C929770E66491D1E4530046D3E758
                                                                          SHA-512:093378E61DE9310F9C48170CBB0FDBD3C79E184DA1489F759B20BCE410006A9D5A793C82E79A46E0AFF0DAA47D9DBAFD605959E491BA9ED4E55D26F293642D32
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Swift_Current) {.. {-9223372036854775808 -25880 0 LMT}.. {-2030201320 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-747241200 -21600 0 MDT}.. {-732729600 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {-684342000 -21600 1 MDT}.. {-671040000 -25200 0 MST}.. {-652892400 -21600 1 MDT}.. {-639590400 -25200 0 MST}.. {-631126800 -25200 0 MST}.. {-400086000 -21600 1 MDT}.. {-384364800 -25200 0 MST}.. {-337186800 -21600 1 MDT}.. {-321465600 -25200 0 MST}.. {-305737200 -21600 1 MDT}.. {-292435200 -25200 0 MST}.. {-273682800 -21600 1 MDT}.. {-260985600 -25200 0 MST}.. {73472400 -21600 0 CST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Tegucigalpa

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):341
                                                                          Entropy (8bit):4.638828647226646
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2903fDm2OHskeoHxbV1ULhgdrV/uF+IcmJ3/uF+ivi9/uF+SNv:MB862903LmdHsVCn1ULSB/uF+QV/uF+q
                                                                          MD5:4C4034ABAB9E4804CCB23E51694044C9
                                                                          SHA1:7DB24CE83AB2C07E6F6784D27C4E3AC0F149D080
                                                                          SHA-256:1F0503579B0DDDBAF88814A278127D9CD7019EDD3C35F4CBFC0EF11C0EDAFE5B
                                                                          SHA-512:0BC366CD3AB2E1388D11770DC8DEC1FC94C48FDC846ABB6C487828BF9FF15CD9A1C15B33E08F6E48B7F4A6F2AD1617FF12B359784CA4C32256D72422E6825105
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tegucigalpa) {.. {-9223372036854775808 -20932 0 LMT}.. {-1538503868 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}.. {1146981600 -18000 1 CDT}.. {1154926800 -21600 0 CST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Thule

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6890
                                                                          Entropy (8bit):3.8331465442823704
                                                                          Encrypted:false
                                                                          SSDEEP:192:mJInJuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/Bm6BTd69xK7KjhVbHyR3h1gOZM:miFCC
                                                                          MD5:D93B62D5F7EEBC28AC047BED2307CAE8
                                                                          SHA1:8B3E02240A01B5AA42D30E86005E880916432227
                                                                          SHA-256:7FB0CBB101D3B6FBB6B9DAD5446BBF9E6AEC65EC38472739E604F68F6AA9AB7B
                                                                          SHA-512:3648106F4DF84CFD94AAD4E9430F8D3BBCB38A9196DE9A59246DFBBC170FADBF106DD1FD08FE2E4F7319BFFB1C2607E4F5D563C222CED8267483D1A0C388CCE5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thule) {.. {-9223372036854775808 -16508 0 LMT}.. {-1686079492 -14400 0 AST}.. {670399200 -10800 1 ADT}.. {686120400 -14400 0 AST}.. {701848800 -10800 1 ADT}.. {717570000 -14400 0 AST}.. {733903200 -10800 1 ADT}.. {752043600 -14400 0 AST}.. {765352800 -10800 1 ADT}.. {783493200 -14400 0 AST}.. {796802400 -10800 1 ADT}.. {814942800 -14400 0 AST}.. {828856800 -10800 1 ADT}.. {846392400 -14400 0 AST}.. {860306400 -10800 1 ADT}.. {877842000 -14400 0 AST}.. {891756000 -10800 1 ADT}.. {909291600 -14400 0 AST}.. {923205600 -10800 1 ADT}.. {941346000 -14400 0 AST}.. {954655200 -10800 1 ADT}.. {972795600 -14400 0 AST}.. {986104800 -10800 1 ADT}.. {1004245200 -14400 0 AST}.. {1018159200 -10800 1 ADT}.. {1035694800 -14400 0 AST}.. {1049608800 -10800 1 ADT}.. {1067144400 -14400 0 AST}.. {1081058400 -10800 1 ADT}.. {1099198800 -14400 0 AST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Thunder_Bay

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8330
                                                                          Entropy (8bit):3.832494305415669
                                                                          Encrypted:false
                                                                          SSDEEP:96:tDbEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:tvEItON0HY2iUmUFLqU
                                                                          MD5:8DD2E298AEB672F32AD8B44A0A84431A
                                                                          SHA1:9687C478FC6803F4FFCA125D921DF821181B8E75
                                                                          SHA-256:0F95CE0A36415B43E7B5E6CD790D3BD9EF6D53F4B7AA0235360C0847CBB3F0C1
                                                                          SHA-512:9380327C04FC48A61423F161DFD4AC1C431278D5B392F585DCEB1D893CB8212C4093A92D5D089BC23DF0B5BB6F99595937999A6B1E843DAE1AF36D76B0858281
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thunder_Bay) {.. {-9223372036854775808 -21420 0 LMT}.. {-2366733780 -21600 0 CST}.. {-1893434400 -18000 0 EST}.. {-883594800 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {18000 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {94712400 -18000 0 EST}.. {126248400 -18000 0 EST}.. {136364400 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {167814000 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {35711

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Tijuana

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8755
                                                                          Entropy (8bit):3.8517632099398114
                                                                          Encrypted:false
                                                                          SSDEEP:96:c4uS6mjvZk53mtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:J6jFOzN6IkWq/WHQt/RY4yP
                                                                          MD5:8F912B1F7E3144EE787E4386B1AE2AF1
                                                                          SHA1:60236FC9AB9C06F614C76357915B57B286721BC6
                                                                          SHA-256:FE3681F580ED7F3F2FD21F510DFF1BEF81BD521737F5846FA15FD309E44E69BE
                                                                          SHA-512:87EA33079EEFED848150884BC41131B2CC49B0AAA5FA10C0700818A8C292F1F3AD928E98C98EF34EFC48F0E3AFB3CBBBE3D09C483A2CDA545DFF7CB77D29CB3E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tijuana) {.. {-9223372036854775808 -28084 0 LMT}.. {-1514736000 -25200 0 MST}.. {-1451667600 -28800 0 PST}.. {-1343062800 -25200 0 MST}.. {-1234803600 -28800 0 PST}.. {-1222963200 -25200 1 PDT}.. {-1207242000 -28800 0 PST}.. {-873820800 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-761677200 -28800 0 PST}.. {-686073600 -25200 1 PDT}.. {-661539600 -28800 0 PST}.. {-504892800 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}.. {-355330800 -28800 0 PST}.. {-337186800 -25200 1 PDT}.. {-323881200 -28800 0 PST}.. {-305737200 -25200 1 PDT}.. {-292431600 -28800 0 PST}.. {-283968000 -28800 0 PST}.. {189331200 -28800 0 PST}.. {19

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Toronto

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):11248
                                                                          Entropy (8bit):3.8061065077303926
                                                                          Encrypted:false
                                                                          SSDEEP:96:lBew85RnK1a8phYBNXEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:lBq5RnK1a8phYTXEItON0HY2iUmUFLqU
                                                                          MD5:0D906EC3F658730131A65C5A770D885F
                                                                          SHA1:BFA72C43BCE0F37F795E974457FBE4A664687B38
                                                                          SHA-256:5A98C6BEDDA4DF608051D702A8E037093A8068E1B85F8F55D42B4468F45662A5
                                                                          SHA-512:CC634DAF4EEC7F57E3AB0C20D891380A7F96DE79602A7B57C6C2BF229DD76A69B399A689FA6D0675380B1432C2115B0C8577DC49C3C9E567A08CAD6FCC3599BC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Toronto) {.. {-9223372036854775808 -19052 0 LMT}.. {-2366736148 -18000 0 EST}.. {-1632070800 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1609441200 -18000 0 EST}.. {-1601753400 -14400 1 EDT}.. {-1583697600 -18000 0 EST}.. {-1567357200 -14400 1 EDT}.. {-1554667200 -18000 0 EST}.. {-1534698000 -14400 1 EDT}.. {-1524074400 -18000 0 EST}.. {-1503248400 -14400 1 EDT}.. {-1492365600 -18000 0 EST}.. {-1471798800 -14400 1 EDT}.. {-1460916000 -18000 0 EST}.. {-1440954000 -14400 1 EDT}.. {-1428861600 -18000 0 EST}.. {-1409504400 -14400 1 EDT}.. {-1397412000 -18000 0 EST}.. {-1378054800 -14400 1 EDT}.. {-1365962400 -18000 0 EST}.. {-1346605200 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-1238954400

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Tortola

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):201
                                                                          Entropy (8bit):4.864308662322047
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290RRKl290ppv:MByMYbpwt290V90b
                                                                          MD5:21D152A2359A4EFDE6DCC304F16096F3
                                                                          SHA1:961B3CFB351615604981114A115D396D1F2006A2
                                                                          SHA-256:46A236EC38F3A122D414208328A462B2A937392ECC6C55F673FB7A402F118D96
                                                                          SHA-512:04A2AD6DDC2E7B0D3F95DA1C731FF553F8CBC0DD6BDFC36FB2EDCE755612103E3B4EA6F3AB7FE63CA60976538EFABF40827539DFC35B7E83129BD48471FE514B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Tortola) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Vancouver

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9815
                                                                          Entropy (8bit):3.8481935495337356
                                                                          Encrypted:false
                                                                          SSDEEP:192:sOR864CjSAG5a9bFzN6IkWq/WHQt/RY4yP:sO664CjSAGYbGBt/M
                                                                          MD5:9423BC81647BC4C37888860CE0518BBB
                                                                          SHA1:37E6E6554576D1DD36C3494EAF0BD169003D870D
                                                                          SHA-256:00B5FB8F37DFF43925C501AEAB039F39F058E002572C4203286317046CC1D700
                                                                          SHA-512:1830CA2B62B7CA6EEB5A924D2148925DF7DD87A7B93B21F4F023E4678EF42DC20BFF57F702923E10F4382FE6757323D21414D094E99FEEB43316DE4A7E5A909E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Vancouver) {.. {-9223372036854775808 -29548 0 LMT}.. {-2713880852 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-747237600 -25200 1 PDT}.. {-733935600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-4

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Virgin

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):200
                                                                          Entropy (8bit):4.914983069791254
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290RXgr490ppv:MByMYbpwt290xg090b
                                                                          MD5:9F7DA15BE387B8F7DEC5DFFE069F3505
                                                                          SHA1:D298B963B0048E9ECA3BC7B85248506AB1388479
                                                                          SHA-256:561D9D04B0CE0F96A9C351C7D5C30AA1D5A42A3D70066CD9AF0DA6CBC5388DBE
                                                                          SHA-512:606C2A918633C74BD2954D39B00EFA2CD9DA852BC7034F129A04258A65DC74942FA0826E9BC6E4433926E7F1375612554B04845077E434D0CD3BD15832DC6B95
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Virgin) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Whitehorse

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2971
                                                                          Entropy (8bit):3.9652694533791917
                                                                          Encrypted:false
                                                                          SSDEEP:24:5CeFvmpn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5BmCKpj/AOZFCARCeQbvb5wxMN6Ix
                                                                          MD5:2F2D39B5FB844E170FA7B6AF11B948CA
                                                                          SHA1:3D89672134D979FCF65225A58249380D9C8A4A65
                                                                          SHA-256:8E0BC71BD7146145DDE3C064AE205DF08124FE2402853A9655B0EB799E90F31F
                                                                          SHA-512:6C046D1133C8CCF697C8FB553A1F539948F71FA80BA447B87AA8D1D1D7113B32A6B764C5C1734C615319A27961B6116FCA087EB571869119BE87656FCA351498
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Whitehorse) {.. {-9223372036854775808 -32412 0 LMT}.. {-2188997988 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Winnipeg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9695
                                                                          Entropy (8bit):3.8209220355628766
                                                                          Encrypted:false
                                                                          SSDEEP:96:pOEhc8/rvNZONqXXyIjNA604qSScBgN+4ctDzIVQ/c/3hNxTh:pY8DvbO+A604qSBgI7DBch
                                                                          MD5:E8DB00D2B99B308018F4F5E48AC47C3A
                                                                          SHA1:8841467CB264DC9F87FABAADBE90EE2C8DACC80F
                                                                          SHA-256:F3FC5F6D93D1D9EB0F3DED33873F33C47F841797D96439966F8E0A5A189941FA
                                                                          SHA-512:5D684B07332ED53F9F8CB71FFF3B6D0F848426A5E4D9E7DA84E49E358C666F1C3BB9CF21352D939B35B558FC691839E24BC84656317F73C768B474AF5AC480EB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Winnipeg) {.. {-9223372036854775808 -23316 0 LMT}.. {-2602258284 -21600 0 CST}.. {-1694368800 -18000 1 CDT}.. {-1681671600 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1029686400 -18000 1 CDT}.. {-1018198800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-746035200 -18000 1 CDT}.. {-732733200 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620755200 -18000 1 CDT}.. {-607626000 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Yakutat

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8683
                                                                          Entropy (8bit):3.957710943557426
                                                                          Encrypted:false
                                                                          SSDEEP:96:po1acs6yyyxC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:p4acsW9DiaJCUbPI+D/iMpCIBSuk
                                                                          MD5:18EC35FCEC15CE9304818E22222411EF
                                                                          SHA1:F4A04B3E2B5F55C9582F578C3142E706C4EB6BD6
                                                                          SHA-256:79B44F245D86A4EC299D1A9A2EDB2AB92D50AB5A7C1C03759D283AC4070F9005
                                                                          SHA-512:40AC47AC278DF22C7ECFF568456E7C3767B38701B9A2E2639C2201DC53CDD794CF7521BCB773A8AF2A8D4A034D3BBD35BF9788FB5B4E4D51A7A139B3B3353479
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yakutat) {.. {-9223372036854775808 52865 0 LMT}.. {-3225223727 -33535 0 LMT}.. {-2188953665 -32400 0 YST}.. {-883580400 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-757350000 -32400 0 YST}.. {-31503600 -32400 0 YST}.. {-21474000 -28800 1 YDT}.. {-5752800 -32400 0 YST}.. {9975600 -28800 1 YDT}.. {25696800 -32400 0 YST}.. {41425200 -28800 1 YDT}.. {57751200 -32400 0 YST}.. {73479600 -28800 1 YDT}.. {89200800 -32400 0 YST}.. {104929200 -28800 1 YDT}.. {120650400 -32400 0 YST}.. {126702000 -28800 1 YDT}.. {152100000 -32400 0 YST}.. {162385200 -28800 1 YDT}.. {183549600 -32400 0 YST}.. {199278000 -28800 1 YDT}.. {215604000 -32400 0 YST}.. {230727600 -28800 1 YDT}.. {247053600 -32400 0 YST}.. {262782000 -28800 1 YDT}.. {278503200 -32400 0 YST}.. {294231600 -28800 1 YDT}.. {30995

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\America\Yellowknife

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7737
                                                                          Entropy (8bit):3.8656193813344064
                                                                          Encrypted:false
                                                                          SSDEEP:96:42GaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:uPlLv/PCenJzS6cy
                                                                          MD5:A7606AE597027C26BC90702B2BCC80E9
                                                                          SHA1:7B2AB2E0A23B8D770D1305A171DBCCE2D471EF2F
                                                                          SHA-256:B33838F12640C64BA4F10F50657EC4D8D5B30FD226DA4ACA21B169B53AD30576
                                                                          SHA-512:B18711B4110D6DB0CC7A6EF66639E1B38323F0B61DA4F5287A51BC9EC8534133568C6D3E4F18F6328564DAD291E0CA707768DE4478DD502A40FFD189C08114A1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yellowknife) {.. {-9223372036854775808 0 0 -00}.. {-1104537600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Casey

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):478
                                                                          Entropy (8bit):4.205595904143294
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2L09xSDm2OHE5QMFUH+KNUoTVsBEE0ZZICxZbDtVby:MB862LcUmdHE5QMFi+KdTVPZIwXDy
                                                                          MD5:7D8132A23238C14CCEDD520BBEB49F77
                                                                          SHA1:A8BAE9269DAA2AC535B292E1AE8632B451A0BBA5
                                                                          SHA-256:04247ACB2B4FA126D13F4573FF74D15A89CF42B2C5CD7E688D5BB1C1FD3972BF
                                                                          SHA-512:74FCB14037B0AE11A95B036791D69037590F8EC7F09D90A866E6A6CAAD6D58E4EC3723A3BB356FBF0E25ED1239A5820A8513EBF6653578E4BFB8988D6D20EF13
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Casey) {.. {-9223372036854775808 0 0 -00}.. {-31536000 28800 0 +08}.. {1255802400 39600 0 +11}.. {1267714800 28800 0 +08}.. {1319738400 39600 0 +11}.. {1329843600 28800 0 +08}.. {1477065600 39600 0 +11}.. {1520701200 28800 0 +08}.. {1538856000 39600 0 +11}.. {1552752000 28800 0 +08}.. {1570129200 39600 0 +11}.. {1583596800 28800 0 +08}.. {1601740860 39600 0 +11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Davis

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):324
                                                                          Entropy (8bit):4.360007144607037
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2L0mDm2OHEfwz0/MVSYyF/KZ7VoX/MVSYyF/VpVQVF9RXhNXSMVSYy6:MB862LVmdHEIjsF/KZOksF/Vp6v9RRFl
                                                                          MD5:97AA556F7EF06786B76316133794F4E9
                                                                          SHA1:B3CDA284DE80987B954E2CC9BFA3ED33462CDD4F
                                                                          SHA-256:2F36D2E13D7E251322B7A7B30F39645393525CEB49A2B5C26F27797F2AAF4D7F
                                                                          SHA-512:14C6F17252C2AC89D86FE00BD8A8934D627C85478B0AB08AB6237988922D18616B00878498FFFC0E1978308BC6D775E2DC3ADCEF827AB0A06B214BE4DDABAB52
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Davis) {.. {-9223372036854775808 0 0 -00}.. {-409190400 25200 0 +07}.. {-163062000 0 0 -00}.. {-28857600 25200 0 +07}.. {1255806000 18000 0 +05}.. {1268251200 25200 0 +07}.. {1319742000 18000 0 +05}.. {1329854400 25200 0 +07}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\DumontDUrville

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):214
                                                                          Entropy (8bit):4.938579775653117
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yci/452HAIgObi/4oA6N/2L0/3Zp5/4pv:MByMdNXiU5t2Lkwv
                                                                          MD5:CC22302B9FAE52E36A2A35C0361E774B
                                                                          SHA1:45CFD95A5821C4C4FDF2E1519F08029FF0BE664B
                                                                          SHA-256:96F2AB9A9FFCD10598FDF105F68460CC4B4EBC1F18054D1BC8E39DF6AD24D1AC
                                                                          SHA-512:FC9084D7B16EAA985681762F2658D32C77EE186D8D3C7225093CC5CB4A6AEB74A3D0A41A904EB6C8AEF7DB110A89497BAFAF811BBC26103F96E5E1D4D4E1002A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Port_Moresby)]} {.. LoadTimeZoneFile Pacific/Port_Moresby..}..set TZData(:Antarctica/DumontDUrville) $TZData(:Pacific/Port_Moresby)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Macquarie

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8447
                                                                          Entropy (8bit):3.850137279218428
                                                                          Encrypted:false
                                                                          SSDEEP:96:s1qigkx6WsYyS391QiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:s1q05h1QiAmcOM6e0pj
                                                                          MD5:81C612A1544910544173687C416841C6
                                                                          SHA1:4A707B403F0B9556A3D3D50B08BE0F56660F3F0B
                                                                          SHA-256:C4EA7F1C0B5A0FAE653419F1C6D058BDDD745A3CDBA11900005C157DF23DDC01
                                                                          SHA-512:122E2DC3D8D61CCDB83E03C9487DD29AABE7AB3F71FE4F6315209AF0BBCFD01FBDC3A1E3F6D910FB0D690378DF852170A9819D8C1EF96BE6BC8C0811BFB453A9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Macquarie) {.. {-9223372036854775808 0 0 -00}.. {-2214259200 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1669892400 39600 0 AEDT}.. {-1665388800 36000 0 AEST}.. {-1601719200 0 0 -00}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {28932480

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Mawson

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.7511104559982
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2L0GRHEzyeyFNMXGm2OHvavFeVU/VPKVVFSTVF9svUX0VQr:SlSWB9eg/2L0zyfXDm2OHEVy/Ur9s/Vg
                                                                          MD5:7A2AD9BD8F8DEE5C600CABF2D5E9D07B
                                                                          SHA1:CF5D230A29946B7FA3ECD8EB99F1EF1BF0FA5B50
                                                                          SHA-256:ACA533B8BC82296373EDEC82F6E0AA45A34D817C7C18FF5E8E94B81C0BD30259
                                                                          SHA-512:95F8FA68735E88AB15C403191928FA4AA5D1628453BE64B87EE7E8DF9F35FB5DA74A3CED5F5289A13D84A8A12BBB86734E578059CA8B6405399CFF5E33C9384C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Mawson) {.. {-9223372036854775808 0 0 -00}.. {-501206400 21600 0 +06}.. {1255809600 18000 0 +05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\McMurdo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):195
                                                                          Entropy (8bit):4.880387042335617
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3ycqXHAIgObOvRN/2L0z6/fy:MByMdTiYt2LrK
                                                                          MD5:88EE32AE5C538AEBFDE2D1D944ED5B2B
                                                                          SHA1:55E7234E6FFF298182A6C8889A9F506CDCE7C959
                                                                          SHA-256:E9D99293C5B275D8E0D7B066084177EDF670D5B52B81E87608BAB02025F33155
                                                                          SHA-512:45A3EA146CA719BA6F22E99EAA57AC1DED1C762E19BDFBA176E5FEAC36EC58586F771572DD16ACE09E660F97DEB91A701BA1B1F1AEF3BD8688F3451C0772420A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/McMurdo) $TZData(:Pacific/Auckland)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Palmer

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2613
                                                                          Entropy (8bit):3.6082359166067905
                                                                          Encrypted:false
                                                                          SSDEEP:48:5fzJS6S4wRSenSOaf7HSKSkSqS7STslSmSMSCSxygSiXS/SrS+S9SfShS7SoSlSL:jdeRtnxaf7HlPlgiot7JC/Xk8NWse4rf
                                                                          MD5:BDFA5908E735F866FEC16F6B481AD385
                                                                          SHA1:524AEE21BB97D923A8812A5722AF2FEA43B4D971
                                                                          SHA-256:1637381A20E9D5C6A530F110BDB08D9515E675C9206F000407D8511074948E61
                                                                          SHA-512:3D65C7941BA15A698264848F9B6F43ED5B63D4CF86D495334E8E1DC381D63435E9424BBBC389229693D20044FDB8425A7CC805AB5EA055F59D3E0DD4C7AC2A28
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Palmer) {.. {-9223372036854775808 0 0 -00}.. {-157766400 -14400 0 -04}.. {-152654400 -14400 0 -04}.. {-132955200 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-101419200 -10800 1 -04}.. {-86821200 -14400 0 -04}.. {-71092800 -10800 1 -04}.. {-54766800 -14400 0 -04}.. {-39038400 -10800 1 -04}.. {-23317200 -14400 0 -04}.. {-7588800 -10800 0 -03}.. {128142000 -7200 1 -03}.. {136605600 -10800 0 -03}.. {389070000 -14400 0 -04}.. {403070400 -10800 1 -04}.. {416372400 -14400 0 -04}.. {434520000 -10800 1 -04}.. {447822000 -14400 0 -04}.. {466574400 -10800 1 -04}.. {479271600 -14400 0 -04}.. {498024000 -10800 1 -04}.. {510721200 -14400 0 -04}.. {529473600 -10800 1 -04}.. {545194800 -14400 0 -04}.. {560923200 -10800 1 -04}.. {574225200 -14400 0 -04}.. {592372800 -10800 1 -04}.. {605674800 -14400 0 -04}.. {624427200 -10800 1 -04}.. {63712

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Rothera

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):151
                                                                          Entropy (8bit):4.829975802206526
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2L0GRHEsKRsMXGm2OHvavFN/H3VVFVGAvFv:SlSWB9eg/2L0rRsDm2OHEN/VVFAKV
                                                                          MD5:C330982049AA053DA62B926627D2F2FA
                                                                          SHA1:050CE68265F1A183F0173C825AC59EAE8B6AB9EB
                                                                          SHA-256:943F10D8E836773F0B7ACD13ED8422C0B27813C7BBE0B09B57697D1D70D21ECE
                                                                          SHA-512:DE9953D0E505D6B110C0CC4E756B5B0311646C9CA4703A33B92147D36CFB4C288D73851E6766CE1432F41AB51B5D0A1D58680BDB4E28F067E1D36F670B4A192E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Rothera) {.. {-9223372036854775808 0 0 -00}.. {218246400 -10800 0 -03}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\South_Pole

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):198
                                                                          Entropy (8bit):4.906125935761354
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3ycqXHAIgObOvRN/2L0tlo+ply:MByMdTiYt2LMq+p8
                                                                          MD5:8095A3749DBDE05377836D74A4EEFE33
                                                                          SHA1:6987CA972B63AE26A65654961588D51D3EF2166C
                                                                          SHA-256:88057832175BB642B23FC99F788A2F78A24005CF1F84A7B1B5E8C84FB8F4D4C1
                                                                          SHA-512:9066104C9C16D2AB88523D651C74CE268468E093A497D128D0D12A986BD62DBC1388A56ED1737C2AFACF04185CF06FD0EE66797A3390B2F0E1EB08A4D92AAFAD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/South_Pole) $TZData(:Pacific/Auckland)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Syowa

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):178
                                                                          Entropy (8bit):4.871844665431957
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2L0GRHEtWlFBQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2L0tQB
                                                                          MD5:CA52057130DCF506D11A7CC069F4FBA3
                                                                          SHA1:2C38B7E7872BB41C3569DFCB539C3EC3AAE24FDD
                                                                          SHA-256:2488805DE4FEA42305689F679F1AE2D80B1E934E657FEA329AD39A82DAC63022
                                                                          SHA-512:B19D409870939C8F0834C6C028239E010EE5128DFA6E97D4903BECA229B04FE530EA376B936767D9BFE21709720C1791289D8E3622B17C18F2680B0670794A02
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Antarctica/Syowa) $TZData(:Asia/Riyadh)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Troll

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5370
                                                                          Entropy (8bit):3.5134546899897146
                                                                          Encrypted:false
                                                                          SSDEEP:96:YveRdmbxnKIJqU9XThVIsopb8BcrFgoZVlzeEG+PtJ:UeRdmNnKIIajfopb3FVVJ
                                                                          MD5:442F495C36B31CA5D7A9BEFF12105AEF
                                                                          SHA1:B3F6CA5B4A5756F9B2C09A27198F7A651CC6032D
                                                                          SHA-256:6FD5AB8B7B308CDCEA4B747A81D8675988AE218813C91714FC4CA97919CEBEA5
                                                                          SHA-512:C6EAECC26D67D218615EBB5602639DAB62A2578BD9683553D765DC1AC5580627D29B6F911388F5F1BFC284278EA4EBECE94630D3C6B95FF9EF93D3D61A3C2028
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Troll) {.. {-9223372036854775808 0 0 -00}.. {1108166400 0 0 +00}.. {1111885200 7200 1 +02}.. {1130634000 0 0 +00}.. {1143334800 7200 1 +02}.. {1162083600 0 0 +00}.. {1174784400 7200 1 +02}.. {1193533200 0 0 +00}.. {1206838800 7200 1 +02}.. {1224982800 0 0 +00}.. {1238288400 7200 1 +02}.. {1256432400 0 0 +00}.. {1269738000 7200 1 +02}.. {1288486800 0 0 +00}.. {1301187600 7200 1 +02}.. {1319936400 0 0 +00}.. {1332637200 7200 1 +02}.. {1351386000 0 0 +00}.. {1364691600 7200 1 +02}.. {1382835600 0 0 +00}.. {1396141200 7200 1 +02}.. {1414285200 0 0 +00}.. {1427590800 7200 1 +02}.. {1445734800 0 0 +00}.. {1459040400 7200 1 +02}.. {1477789200 0 0 +00}.. {1490490000 7200 1 +02}.. {1509238800 0 0 +00}.. {1521939600 7200 1 +02}.. {1540688400 0 0 +00}.. {1553994000 7200 1 +02}.. {1572138000 0 0 +00}.. {1585443600 7200 1 +02}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Antarctica\Vostok

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):150
                                                                          Entropy (8bit):4.825276519494304
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2L0GRHEoKcMFPMXGm2OHvavFYd/bVFXKVVFSTVVn:SlSWB9eg/2L0XcMFPDm2OHEsVFXK/UX
                                                                          MD5:EEF1A803C78FEDC2848A967F8F7C8C28
                                                                          SHA1:AC0E8008EFE4EF1A393478C82724335EA30BF1CD
                                                                          SHA-256:1EFDAE8A23BA4EE37E7992F3C9DCADA6C2E95AF82A955A4C6597E7295C950855
                                                                          SHA-512:F19EA119EA4F354099402FDEEAAA551AA2C5FC1295E40B5A82E5896CB41F0C86AD8CAA86FDC4E7BD30AAF0ABAF2794FE7B177C4FE25A89F1C744C400A140AA88
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Vostok) {.. {-9223372036854775808 0 0 -00}.. {-380073600 21600 0 +06}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Arctic\Longyearbyen

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):181
                                                                          Entropy (8bit):4.968479138333469
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVyWJooeyXHAIgoqxWJz5RL/2XbeLo4cA4FH/h8Qas:SlSWB9vsM3ymSDSHAIgoXN/2XbUyAK8K
                                                                          MD5:3FE28E22313BA8C8100254644DBFD164
                                                                          SHA1:46F917F0E706CD072B89C06652DAA032CD67AD98
                                                                          SHA-256:944A38702A5176A082755897F1E4B1C88D5721CB499245E2FE51D2CFD849A23F
                                                                          SHA-512:BF6E42C039C780EB62CFD69B0375EFF9D459E6468CAFE2323A086D2EB2039B97F805BC361962C72F51F527E96B51973298F13774427E38A28E851A9D19664820
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Oslo)]} {.. LoadTimeZoneFile Europe/Oslo..}..set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Oslo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Aden

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):171
                                                                          Entropy (8bit):4.829666491766117
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFK4h4WFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKs46
                                                                          MD5:60D7F3194F19179E0CF0F561F9C40EE6
                                                                          SHA1:B079EC49485CFBFFB7A5BE6149319B75684258E9
                                                                          SHA-256:8FCDDB246932BAED880B70C0CA867057E7989AEA55EDDC174430E1055CD1058D
                                                                          SHA-512:0BDC86B1D473D4875C6F7C092F955D0999E6C1F2EF83CFC7726A3C5BFEB0F5CB8E00B1F0CBC1F91F806EC635C472927504DF681A32DAC55EF372DA16FEA9EF40
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Aden) $TZData(:Asia/Riyadh)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Almaty

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1637
                                                                          Entropy (8bit):3.732051305399264
                                                                          Encrypted:false
                                                                          SSDEEP:24:5qehddmvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10SvPFu+a+CK/Eu3CWuD0Vob1:5YvdJqxiF0rvK50Sv9fGSM
                                                                          MD5:D6BCB21F65642F36A159AFD72EC93953
                                                                          SHA1:D3E670E579924E6E4F04AB574D48334FF521D8B2
                                                                          SHA-256:06DC608C0B8CDD69CCE66A6BF86F141C46DF39CB45312E684E46F19ED8CAFF15
                                                                          SHA-512:9A633B629873E5EE5AF923A94865EBE5FD9ECA181B2C47B7368A0828468715E07AD3FD825D5E2312D2D0BA1FA5490E3817C36B6339824C8012A0B75538C4A0DC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Almaty) {.. {-9223372036854775808 18468 0 LMT}.. {-1441170468 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {695768400 21600 0 +06}.. {701812800 25200 1 +06}.. {717537600 21600 0 +06}.. {733262400 25200 1 +06}.. {748987200 21600 0 +06}.. {764712

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Amman

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7301
                                                                          Entropy (8bit):3.7085177447035047
                                                                          Encrypted:false
                                                                          SSDEEP:96:Fz0T52akyId7+xOXdkwqeIFcvQdaKkIQV9aOBmGILnNoRkEKnFj/XmJmoTSVI:FY85S0VqXFcvQMZUnNrK
                                                                          MD5:C5521EB658601F0C03F3122A1529B7B9
                                                                          SHA1:0B0F9BD69F3B49DF5D25A9F567471409D7467ED8
                                                                          SHA-256:AA5E87C065E5AA4516F1AA50E1840EE22683D3B4C25A4E00CA92C53F96C6D062
                                                                          SHA-512:B16039183DF4AF64768F4956075E9557988466E4FC327968712958186CB8F804C1F1B0ED80F5EC7900521CC5710E8AA0DD6716C3B58F7B31116E22CB5785C000
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Amman) {.. {-9223372036854775808 8624 0 LMT}.. {-1230776624 7200 0 EET}.. {108165600 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {215643600 7200 0 EET}.. {231285600 10800 1 EEST}.. {244501200 7200 0 EET}.. {262735200 10800 1 EEST}.. {275950800 7200 0 EET}.. {481154400 10800 1 EEST}.. {496962000 7200 0 EET}.. {512949600 10800 1 EEST}.. {528670800 7200 0 EET}.. {544399200 10800 1 EEST}.. {560120400 7200 0 EET}.. {575848800 10800 1 EEST}.. {592174800 7200 0 EET}.. {610581600 10800 1 EEST}.. {623624400 7200 0 EET}.. {641167200 10800 1 EEST}.. {655074000 7200 0 EET}.. {671839200 10800 1 EEST}.. {685918800 7200 0 EET}.. {702856800 10800 1 EEST}.. {717973200 7200 0 EET}.. {733701600 10800 1 EEST}.. {749422800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Anadyr

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2086
                                                                          Entropy (8bit):3.7698340044911616
                                                                          Encrypted:false
                                                                          SSDEEP:24:5DeEdVrEOeFt7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5ZejsFLrcZwvJt2F+doTr9Q3G80
                                                                          MD5:6EFC35043BDCA4AB61D72E931DB954E6
                                                                          SHA1:F0B4E76C154DC773073E41AA8E94030E972A986A
                                                                          SHA-256:D9DF64FDA4638F7604624B0F68A885D5ABADB1DE12AF1AF5581C2AF7DD971562
                                                                          SHA-512:16AE582B113D6960C73B64620A8AF20F9D436AA4B3EC8E881617AED3389EB4357931882103F162F19EE8202953A7E6FB4FDD6D7760FB7621F4DB9D229AD13F17
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Anadyr) {.. {-9223372036854775808 42596 0 LMT}.. {-1441194596 43200 0 +12}.. {-1247572800 46800 0 +14}.. {354884400 50400 1 +14}.. {370692000 46800 0 +13}.. {386420400 43200 0 +13}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Aqtau

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1665
                                                                          Entropy (8bit):3.7149890651919644
                                                                          Encrypted:false
                                                                          SSDEEP:48:5uvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIkhYwr:sFBNKs6b03zB0WJEuDa7sFZiKWaN6TiF
                                                                          MD5:A72FB1FE01C93BD7E0A8136635C72639
                                                                          SHA1:2383CF839F50784D4BF8B7EDDB324C80E2DDD0DC
                                                                          SHA-256:96B510AF9B8C6BC1DFA84E9ED5E072F3FD484EEB66BBEBC7B6826ED859ED9027
                                                                          SHA-512:061FECE3C750C0229638DD8AF38FB3E8E48E59E0DE1B13BCFE46483A7A170B71B9BCB0D6F110B6B2EF68510FA940F9066F14CBD59829E222D6644D3657CE1893
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtau) {.. {-9223372036854775808 12064 0 LMT}.. {-1441164064 14400 0 +04}.. {-1247544000 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {7647156

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Aqtobe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1666
                                                                          Entropy (8bit):3.721746335201775
                                                                          Encrypted:false
                                                                          SSDEEP:48:5FUvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQR:PwaBNKs6b03zB0WJEuDa7sFZiKWaN6Tt
                                                                          MD5:E278B985BD2515DBCAED8CB741BE9208
                                                                          SHA1:BC9F5E72C430661D7ED1AF04571CE5D0F73DD18D
                                                                          SHA-256:991638FA2AB2A2F7A091A23D78D99306EE73A740F1A03FBAC448EDCAB55A0E38
                                                                          SHA-512:9951DB729B837647CC4B3D2E605525DCCBAFFD39D76460331BF62235DCAE5E4470CDA578F940B1739AABFEC55D293FF60D79AE0EFDFE1EB64E84571881FDEA6A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtobe) {.. {-9223372036854775808 13720 0 LMT}.. {-1441165720 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Ashgabat

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):878
                                                                          Entropy (8bit):3.937249024843323
                                                                          Encrypted:false
                                                                          SSDEEP:24:5ggeRMdIQvNcDvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKTob3CGcr:5gbkvNSvNhQQvmRKqv0fvzQIovWdvEGD
                                                                          MD5:259179C7A1CA04F9F3A373B6C8FCB8C5
                                                                          SHA1:D042DF8EFD8EC1473B45B1131BD5EB714F1B2C17
                                                                          SHA-256:13745BFA25E6E2D8D0FABAE42CB7C37CF9F974CFB343D4FE84E4E2D64A25926B
                                                                          SHA-512:703BEAD5A1E5B3816D98057A08A87C2139F418787F38561FE35175B84E2005365727F85D1B949CC5DF464B207A7D01BB65FB1A632E73DDA523E843B82D76FBBD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ashgabat) {.. {-9223372036854775808 14012 0 LMT}.. {-1441166012 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +05}.. {370720800 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Ashkhabad

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.801820439218014
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8xEYM4DyXHAIgN/ZEYovFvWARL/2WFKUNSH+WFKYEQ:SlSWB9vsM3yR+HAIgH8VWAN/2wKUNSeq
                                                                          MD5:5193EF7ADB646798801245BC50C8DDA6
                                                                          SHA1:83ED851CBC60EFB330A8FC119E1BED5B4C0BA630
                                                                          SHA-256:2C752F641B98E3C05B14AE31330D1F198DAA4A7E354BA9670C7754926BFB891A
                                                                          SHA-512:E940E1BE67A9AC895F3D060B1CB34797A429147A9DC2AC0F1162D37D86661EF217EDABA720F0AE3796186FE801229210AC785BB4511CBBE5A41791D236101D8C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ashgabat)]} {.. LoadTimeZoneFile Asia/Ashgabat..}..set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Atyrau

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1666
                                                                          Entropy (8bit):3.7265766742957402
                                                                          Encrypted:false
                                                                          SSDEEP:48:55TvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQJ:XrFBNKs6b03zB0WJEuDa7sFZiKWaN6Tl
                                                                          MD5:0236793F90ABC6F68718DDBB44AF5E2F
                                                                          SHA1:A5EFAEEF9B9159E748A3FED231F8A978E400482E
                                                                          SHA-256:4B7B118E6AE72D41740CF0CB2BD8E970700758DCBC0DD6F298199D841DF8408E
                                                                          SHA-512:851C7A9C110790454312BB9C5B5D3C426365EEF4673191B9ABB2E4A32301894C5FB1ADCBE2A4C67BEE416AD63FB8BED85F94EF9BF42473DA4BFFA7824935A1D5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Atyrau) {.. {-9223372036854775808 12464 0 LMT}.. {-1441164464 10800 0 +03}.. {-1247540400 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764715

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Baghdad

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1702
                                                                          Entropy (8bit):3.7261419515679393
                                                                          Encrypted:false
                                                                          SSDEEP:24:5/eVvyGiHD6UC4UrUomFMmUZcjbUKNFcUEUvUOpU8MYUWCUlbf/U9bUiUUybUQUF:5m8G9mFdnNF1FfsTuvQXHCe
                                                                          MD5:690013310A46BD1AE250A5E019353809
                                                                          SHA1:0DF434C7EEB707DC071007FAB112F4DEB37E936F
                                                                          SHA-256:D20B75D2604C3B742C1629C5EE02CFF6783E472249982B272B68F2A6DE9BDC38
                                                                          SHA-512:FF8C33E55E4F006C38D3FD37A1AD3E1200718CA374ECBEAE8255C7635912F0BB23A59A600BF7130D5660A24C515F726E8440D0D908E560CB59F74059638E6AA2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baghdad) {.. {-9223372036854775808 10660 0 LMT}.. {-2524532260 10656 0 BMT}.. {-1641005856 10800 0 +03}.. {389048400 14400 0 +03}.. {402264000 10800 0 +03}.. {417906000 14400 1 +03}.. {433800000 10800 0 +03}.. {449614800 14400 1 +03}.. {465422400 10800 0 +03}.. {481150800 14400 1 +03}.. {496792800 10800 0 +03}.. {512517600 14400 1 +03}.. {528242400 10800 0 +03}.. {543967200 14400 1 +03}.. {559692000 10800 0 +03}.. {575416800 14400 1 +03}.. {591141600 10800 0 +03}.. {606866400 14400 1 +03}.. {622591200 10800 0 +03}.. {638316000 14400 1 +03}.. {654645600 10800 0 +03}.. {670464000 14400 1 +03}.. {686275200 10800 0 +03}.. {702086400 14400 1 +03}.. {717897600 10800 0 +03}.. {733622400 14400 1 +03}.. {749433600 10800 0 +03}.. {765158400 14400 1 +03}.. {780969600 10800 0 +03}.. {796694400 14400 1 +03}.. {812505600 10800 0 +03}.. {82831

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Bahrain

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):171
                                                                          Entropy (8bit):4.784355129067593
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8hkXHAIgNvZORL/2WFKENUKMFB/4WFKKB:SlSWB9vsM3yBkHAIgPON/2wKENUr/4wT
                                                                          MD5:1B5E0D449DAEF469D586A853CB3073AD
                                                                          SHA1:FD735B0472B31644E787767B82B737CC39EC4175
                                                                          SHA-256:3D437037FBF2BBDF969C8E71967080947F24860D431B39F5D8F23151316ABCD5
                                                                          SHA-512:2A2DC33D4258A5E1AE59172883F3B11723798ED35CF5AF1B8BA81A8807DC6F8222C8044D82B152EF6AF43E7350FEB2625D4406C6C7DD309CE65810EA3D3286B6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Qatar)]} {.. LoadTimeZoneFile Asia/Qatar..}..set TZData(:Asia/Bahrain) $TZData(:Asia/Qatar)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Baku

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2149
                                                                          Entropy (8bit):3.6155622322573713
                                                                          Encrypted:false
                                                                          SSDEEP:24:5/eFdqlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUTIEjvZJ+76:5RsUf8mFpNWFny1ZGMte3aivUKo
                                                                          MD5:294DFC98F67AC00A188EC3D3B87C501C
                                                                          SHA1:93C434CD9AA170E35AD676C88EE09986A94EC02A
                                                                          SHA-256:873E8F08B87610D0DAFE239D32345248A4595C6B13D1DA83EC214D78E88FA12C
                                                                          SHA-512:5346082CCA733724C0D2C36B768467E59BA9ED6452B6CF1BA923AF4F0D2BC05C67DB49E804CA81DAD449D30D0835026D708D9AB632D02FDA1EA1A0BF717111DE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baku) {.. {-9223372036854775808 11964 0 LMT}.. {-1441163964 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 14400 0 +04}.. {820440000 14400 0 +04}.. {828234000 18000 1 +05}.. {846378000 14400 0 +04}.. {852062400

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Bangkok

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):181
                                                                          Entropy (8bit):4.911309754748998
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFKELYOiMXGm2OHB+keoHvZKmrROpDovFFsQ+8EXVeVSYe:SlSWB9eg/2wKELeDm2OHxeoHvZ3FO1og
                                                                          MD5:9AC4947AC29C797055B7EBFA4F6AC710
                                                                          SHA1:E7758A9A8BFA255F6B2D27F5366D9FE2A26DDF6C
                                                                          SHA-256:6E72BA908F250FD45D554A12E3E7B3BD2F1C02A6C2431F806FD2A054F843AA90
                                                                          SHA-512:F9D0F0CB7D3726C2AB3B5049429172D9DD4BA21353F6F98570CBA4EE969F7D97BD973CB165AECFF930AFFA8633E8052624D44EE7FB91763681ED3F78A61F4F98
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bangkok) {.. {-9223372036854775808 24124 0 LMT}.. {-2840164924 24124 0 BMT}.. {-1570084924 25200 0 +07}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Barnaul

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2117
                                                                          Entropy (8bit):3.7025684250364725
                                                                          Encrypted:false
                                                                          SSDEEP:24:5VeTtXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEnsr:5n40yVRB7VfXucdKmtTTDOV
                                                                          MD5:6CC13B6910412A3A3D16CA36ADF00352
                                                                          SHA1:061CF4A8FEA8C139F50F96E6B6506B50ED3DD792
                                                                          SHA-256:992F93A7975F8CD4E94D96B3BA1ECFB3585E52A53F4442A15993402D3F955F66
                                                                          SHA-512:4E9750B1C3C0BA4F7922BCBC76276A3E74031D78A98E21DC59F66D6EA8E1B70865BBEB50A6B77EB0423421A18428B97B47412053CE15213128CEED669F4DD6E8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Barnaul) {.. {-9223372036854775808 20100 0 LMT}.. {-1579844100 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {76470

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Beirut

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8024
                                                                          Entropy (8bit):3.7230911686481774
                                                                          Encrypted:false
                                                                          SSDEEP:96:4nBKPP8LFH0TDkywaZb1QSCK5VUjiO1PoBQpo7778CZicJZS80EGcLt4Mok1MgJl:4M38LCRZb+sAiO1PoBQpo1ikjD
                                                                          MD5:1D99E2BBB01B1669403CFBAF7E03F733
                                                                          SHA1:DBDD58C7FD195FC602C4541D6F416CC96094C121
                                                                          SHA-256:17AF14646D562AFE17DCCFD1D2FBA95C122F3E0263906A36EB48BFF04ACF233E
                                                                          SHA-512:98524E8DCD17C090058F17BDA1200D9801EB1B14EB5CEB8C31149A4A402A53BA4923A2AFF457E0A72DAA601D88095247806F945F704000F874FCBF73631DD135
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Beirut) {.. {-9223372036854775808 8520 0 LMT}.. {-2840149320 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1473645600 10800 1 EEST}.. {-1460948400 7200 0 EET}.. {-399866400 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336794400 10800 1 EEST}.. {-323578800 7200 0 EET}.. {-305172000 10800 1 EEST}.. {-291956400 7200 0 EET}.. {-273636000 10800 1 EEST}.. {-260420400 7200 0 EET}.. {78012000 10800 1 EEST}.. {86734800 7200 0 EET}.. {105055200 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {212965200 7200 0 EET}.. {231285600 10800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Bishkek

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1669
                                                                          Entropy (8bit):3.7443715330695735
                                                                          Encrypted:false
                                                                          SSDEEP:48:5qvdJqxiF0rvK5XvV4vUzvCjvT7voPvkPvJUbvn0vYpv99v3uvuWvKJhv3T:Ad1mzK5/VkULCbTjoHkHJUDnQYV9p3mO
                                                                          MD5:1EE8FF3DF0D931A140ADBB021EB3BFEB
                                                                          SHA1:F1F15EF70C4E9F456849AF89CAC97AD747D9E192
                                                                          SHA-256:1D5E9A8F6A04273AF741F648EF10718B004A60D7884FE432DDF85A8F558BEA98
                                                                          SHA-512:155539A5CF21A34FBFACBF1652D934BF32255F4E505E60B3B4D8B5F2F7FAE552E6CB4824D8608A9C56370F58E48702335995BBD16B7A296A86A72A615FBC8ABC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bishkek) {.. {-9223372036854775808 17904 0 LMT}.. {-1441169904 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {683586000 18000 0 +05}.. {703018800 21600 1 +05}.. {717530400 18000 0 +05}.. {734468400 21600 1 +05}.. {748980000 18000 0 +05}.. {765918000 21600 1 +05}.. {78042

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Brunei

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.843807524560784
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFKXeAMMkSMXGm2OHCQdvVVoHsWUOVFW/FvOVSSFdaUMWO:SlSWB9eg/2wK0iDm2OHCIvVVoH3UuW/N
                                                                          MD5:37B0C37CDDEE62E6002AF3D09B0B6225
                                                                          SHA1:75F1329492C231587FE233175D9B71112DA09B08
                                                                          SHA-256:A4216B59F2478DE7E88A99E2B11BBBD93070477D7E62BFD453D1CA430EBB4834
                                                                          SHA-512:6FDC5C74F927970DA261A5842D9647E97163009A2902C8A8AB6DFAACF261485AB179495D2D72FAC513D1A27F662553F1F0EEC8687E009EA5753D5A9E6B0A0D34
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Brunei) {.. {-9223372036854775808 27580 0 LMT}.. {-1383464380 27000 0 +0730}.. {-1167636600 28800 0 +08}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Calcutta

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):178
                                                                          Entropy (8bit):4.774027471796823
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq864DyXHAIgN1QvRL/2WFKh0s+WFKvovn:SlSWB9vsM3ya4DSHAIgcvN/2wKN+wKvy
                                                                          MD5:8BB098AB77CB0469B1FA0E0B64C4A9E7
                                                                          SHA1:88C73626985071DD0923E1CAB343ACCD854A7297
                                                                          SHA-256:1BAEF7850111D2C33B2A766A8AE804534ABA1711BF80A4087A89656DDD8469D5
                                                                          SHA-512:82216A7F787AF20A4C97C7AA754CD6BE979FEF24137CF9A8B18EECA5E8FBCF12834DD8A6FC9CD2357D807F1629806745B46B11DC0472E0284E18DCCC983897DE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kolkata)]} {.. LoadTimeZoneFile Asia/Kolkata..}..set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Chita

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2086
                                                                          Entropy (8bit):3.6981807774781017
                                                                          Encrypted:false
                                                                          SSDEEP:48:5Bpr1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2M:95PhtjLiII2ZFlgd
                                                                          MD5:69E03A5CEB689E19B60168C0F7EBAE8E
                                                                          SHA1:95C6396EB753753B4FE4AE1B98D76332523E72A4
                                                                          SHA-256:10B6F435B05D887176A4D90CA5AC957F327F62F36F15D6F6E4F81844662429B9
                                                                          SHA-512:DFA72EDC54A11F0840ADBEE7F5AD8EA472AA52A1F196292F1341CD92A68FB2EC0A5BC7DE6C8E83C975420DB4B76CECD4393370FDB2C09F86EC11A50E540F6F02
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Chita) {.. {-9223372036854775808 27232 0 LMT}.. {-1579419232 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647012

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Choibalsan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1619
                                                                          Entropy (8bit):3.775783980828041
                                                                          Encrypted:false
                                                                          SSDEEP:48:5th5fSW2sp4Qh2rRSQnGw7GywvWbC25XrMYWG4AIQTUhp9pkTGdXguHaena44XY5:rh5kpmWG29QFUmD
                                                                          MD5:540A7304A62ABB8D7F84454ABD6E2556
                                                                          SHA1:52C37529929218A668D7A4AD6FD1B5FE0A727E16
                                                                          SHA-256:94B2C14EF45C695EF6B19D94722E1BCBB629A595F2866DBA80F00A66721040B5
                                                                          SHA-512:3B535D109DB369E301D6B412F21EC990976B997826F22B2E16ECEEEB048D60F064C7CA1A616393DC2F1B491BAC0548DC0965B9EA149A95280FFDBCAD6726EF0F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Choibalsan) {.. {-9223372036854775808 27480 0 LMT}.. {-2032933080 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 36000 0 +09}.. {433778400 32400 0 +09}.. {449593200 36000 1 +09}.. {465314400 32400 0 +09}.. {481042800 36000 1 +09}.. {496764000 32400 0 +09}.. {512492400 36000 1 +09}.. {528213600 32400 0 +09}.. {543942000 36000 1 +09}.. {559663200 32400 0 +09}.. {575391600 36000 1 +09}.. {591112800 32400 0 +09}.. {606841200 36000 1 +09}.. {622562400 32400 0 +09}.. {638290800 36000 1 +09}.. {654616800 32400 0 +09}.. {670345200 36000 1 +09}.. {686066400 32400 0 +09}.. {701794800 36000 1 +09}.. {717516000 32400 0 +09}.. {733244400 36000 1 +09}.. {748965600 32400 0 +09}.. {764694000 36000 1 +09}.. {780415200 32400 0 +09}.. {796143600 36000 1 +09}.. {811864800 32400 0 +09}.. {828198000 36000 1 +09}.. {843919200 32400 0 +09}.. {8596

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Chongqing

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.865222436335267
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKh2V7/4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKho4wKU
                                                                          MD5:C5DC40C6325391F7247251ADB2C07F78
                                                                          SHA1:3DDB1BF94532FB1F1271095B9C8CAA779BC545EF
                                                                          SHA-256:A87382DC5F3C3141547A65E3746AF1DAF94B51468B96DA6CEF30E95754C97D37
                                                                          SHA-512:062FF8D5E5392E5372B0405EDF3C7CF997AC33F95EBFFAA9CC9AB82BBE27B60C80255FCCEE9E6F5E02CBFCB163F99984BB2103217FFD1F80BDEC5C684BF2F61A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chongqing) $TZData(:Asia/Shanghai)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Chungking

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.889115378893491
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFK7LeL9J4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wK7LUT4wj
                                                                          MD5:C3676771EB813B346F58A7B574D0D7B5
                                                                          SHA1:A473EF621309E019F29F3DEF95C38593775B8404
                                                                          SHA-256:D6D2B4A761C547F1F853AE901AC71AB49FBE825037079C4E0C89DC940AE4A822
                                                                          SHA-512:21C3A5D499E6E0427FBF585CA8CC5D99D193C586483AB107C4D8E9F9DC8412021E8E019A314757DAFE1225D2635F6D48E9C54A511709863F22A02449FA201E02
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chungking) $TZData(:Asia/Shanghai)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Colombo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):369
                                                                          Entropy (8bit):4.465596050904646
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKr+iDm2OHgoHvZv9tdvjSWV/FSQipPUrKkTD/k5QqRVVFSQOR/UIp:MB862zZmdHgCvZvJvj1Nj+Phkv/YtvjA
                                                                          MD5:9541BB43E79AB0C6E8163945B5BFB1BF
                                                                          SHA1:C4994420DB8313DECDE19B4B9F6C5DB0126A95A7
                                                                          SHA-256:E5B5E6D607A15DA65CB00C92C35A63EAF25F547E64CB34BB419CB8CFC2714B1B
                                                                          SHA-512:46F623B3F7CF8A50F97DD812521398EB9100C9CDFB967C18EF1BD112306AAEB3C9CB224424E48611CB8CC21D1DC3D820DD83032D12BC9DF19301CF07786FA664
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Colombo) {.. {-9223372036854775808 19164 0 LMT}.. {-2840159964 19172 0 MMT}.. {-2019705572 19800 0 +0530}.. {-883287000 21600 1 +06}.. {-862639200 23400 1 +0630}.. {-764051400 19800 0 +0530}.. {832962600 23400 0 +0630}.. {846266400 21600 0 +06}.. {1145039400 19800 0 +0530}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Dacca

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):169
                                                                          Entropy (8bit):4.786111096226559
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8ntyXHAIgN6KyFvRL/2WFK1S2WFKwBn:SlSWB9vsM3yHtSHAIgMKON/2wKM2wKwB
                                                                          MD5:BA575D37459540907A644438071277F8
                                                                          SHA1:14CF10D6AABBAF7BAE42B3B9641D8469C206567F
                                                                          SHA-256:B3AD560F66EA330E54A147017E6E6AB64452A5255D097B962D540836D7B19EE7
                                                                          SHA-512:9CA386EF4D812B00C2E63558B81B273F92BBCA98AF304C9FD6FC166210FC4E2F92B769E1D6FB96B670650DC76EFFAD2FC6E39AE12C24B47EAED4E50A2AFAC2D7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dhaka)]} {.. LoadTimeZoneFile Asia/Dhaka..}..set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Damascus

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8311
                                                                          Entropy (8bit):3.719987853637512
                                                                          Encrypted:false
                                                                          SSDEEP:96:8YI5WpVAdVGlkBOLh8X0CkBheIFlPup7YI6z0Y3lV9Jitv5F6Ya7vEzg93kn/R:8dIpqdk6BrqhXFlPUsz57AbV
                                                                          MD5:DCB84F498498C06953E7FC1A4FD9AF17
                                                                          SHA1:5B5A115CDA727C9439667E3E95CA3333E49BA810
                                                                          SHA-256:7D44F4C16E862752D399999B9F0B1E4E8ED5D80C1322A980094801DD8A4A03EB
                                                                          SHA-512:DC143B6DB263377413D4BBC9575236D525F6ED898934CB9A2FC1E3B32E1235F2D86BD8E133B38463DFC143EC2F6E8AA9184048479A4E797C39D63A1AD364BB74
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Damascus) {.. {-9223372036854775808 8712 0 LMT}.. {-1577931912 7200 0 EET}.. {-1568592000 10800 1 EEST}.. {-1554080400 7200 0 EET}.. {-1537142400 10800 1 EEST}.. {-1522630800 7200 0 EET}.. {-1505692800 10800 1 EEST}.. {-1491181200 7200 0 EET}.. {-1474243200 10800 1 EEST}.. {-1459126800 7200 0 EET}.. {-242265600 10800 1 EEST}.. {-228877200 7200 0 EET}.. {-210556800 10800 1 EEST}.. {-197427600 7200 0 EET}.. {-178934400 10800 1 EEST}.. {-165718800 7200 0 EET}.. {-147398400 10800 1 EEST}.. {-134269200 7200 0 EET}.. {-116467200 10800 1 EEST}.. {-102646800 7200 0 EET}.. {-84326400 10800 1 EEST}.. {-71110800 7200 0 EET}.. {-52704000 10800 1 EEST}.. {-39488400 7200 0 EET}.. {-21168000 10800 1 EEST}.. {-7952400 7200 0 EET}.. {10368000 10800 1 EEST}.. {23583600 7200 0 EET}.. {41904000 10800 1 EEST}.. {55119600 7200 0 EET}.. {73526400 10800 1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Dhaka

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):364
                                                                          Entropy (8bit):4.412125512631861
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKwiDm2OHEmVFnoHv9vX+Yl7UIFckVVFSQiL/FG/UIvy/Ur9i/Ur97:MB862Y2mdHzdCv9P+Y9vvjeQlP9/9VkK
                                                                          MD5:B5496A038AC230B9D75AA22BB2BE6BDD
                                                                          SHA1:ACFD9C78F803F344272E8E188C41ED969EBADA16
                                                                          SHA-256:BFC4562055CC4355E79F9EFAA580A4C6A658285916159A5D390A0CDA96A97E98
                                                                          SHA-512:AB05D0176DADC1ED03CC526C372B9827A5FA03459E4F4B4365C6CE4B6FBDA043514A9D3FE2DA747159C5A1BC0E07727E6578A101E42B4DB120AF9624368C5FEA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dhaka) {.. {-9223372036854775808 21700 0 LMT}.. {-2524543300 21200 0 HMT}.. {-891582800 23400 0 +0630}.. {-872058600 19800 0 +0530}.. {-862637400 23400 0 +0630}.. {-576138600 21600 0 +06}.. {1230746400 21600 0 +06}.. {1245430800 25200 1 +06}.. {1262278800 21600 0 +06}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Dili

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):235
                                                                          Entropy (8bit):4.597480383845617
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKCXeSDm2OHnBGeoH1mpvyvScHTU71avScr:MB862qXbmdHnBvC1SyHHq8Hr
                                                                          MD5:316DDF860FA234621698EB473E558DB7
                                                                          SHA1:35BF955F764555945CF8B314B8E881DAD6CF557B
                                                                          SHA-256:8BC2E0D77AC35B6D63E11B820AC45EC23A4195ED773680C600C772FDF4B953F8
                                                                          SHA-512:D1A8D5F1DAAB7827BDCBC14506AF8681FD1ED94C6101CC4A3C8CC2A76EA7D3649038069158C539A2007A1B0734FBD87DE120415E07A3F08F44417100C95459F5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dili) {.. {-9223372036854775808 30140 0 LMT}.. {-1830414140 28800 0 +08}.. {-879152400 32400 0 +09}.. {199897200 28800 0 +08}.. {969120000 32400 0 +09}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Dubai

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):148
                                                                          Entropy (8bit):4.97292023820863
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFKQUMXGm2OHvkdoHsQK23NVsRYovV:SlSWB9eg/2wKQUDm2OHvsoHxVNSN
                                                                          MD5:861BA4A0A71E6C3F71B90074275FD57C
                                                                          SHA1:BC6FC5233340BB19AE4BD0BA563875479AC0A2B9
                                                                          SHA-256:3DB174F1568BC23BF467A3DC7BAF8A2A2952B70653D4DE54F4DB391EC50B6925
                                                                          SHA-512:B187735E0783F299253D9F93E002AEFF131FCCA50FB3E04CF0545B334B051D5ED978108A47C6957B608F5F93ED4CC3D69751FE0F40413719EE1C0440CD49AC76
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dubai) {.. {-9223372036854775808 13272 0 LMT}.. {-1577936472 14400 0 +04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Dushanbe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):820
                                                                          Entropy (8bit):3.969189280047274
                                                                          Encrypted:false
                                                                          SSDEEP:24:5we3dJvOt81FCuLqecDngO6jPvTpYy5T4TiFGDr:5BvdJqxiF0uGr
                                                                          MD5:9ABD0ECB5F3E738F49CDD1F81C9FF1A4
                                                                          SHA1:46B68C7BBD1BE9791B00128A5129AA3668435C93
                                                                          SHA-256:550DB44595F59D0F151BE4AF70D6FECE20580AB687EF45DE2A0A75FB2515AC80
                                                                          SHA-512:67E2B0EF216D509C4B6DD367519E0A733E54A7CA767D5F7960715E8056E61B7B633C7516D568544F55C9277E90412C1443B822C6EED3341C01F1BD9AA9476FA1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dushanbe) {.. {-9223372036854775808 16512 0 LMT}.. {-1441168512 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 21600 1 +06}.. {684363600 18000 0 +05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Famagusta

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7597
                                                                          Entropy (8bit):3.7170041442081203
                                                                          Encrypted:false
                                                                          SSDEEP:96:G3pv/7V6Aj8aZaNlK0UpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:G3v/AaaivBeRF+W35Syrwl9h5j
                                                                          MD5:F8E4BA3E260452AE13CF234E60149A62
                                                                          SHA1:8DDB08E2FDEEF6539EE0C0038B166908BFED16CD
                                                                          SHA-256:8CFE85C48FC22033411432F8B75EE4C097A5D84897698CB1AFD5AB51C47FF5A3
                                                                          SHA-512:487177411FB7E9F83AB9AAD84B685322B13A85784D4F90BB9C30F57BFAA6A9298E5C4F36C97444DE1117E51F85A62DC639D08B405460D071C2B29C898553E9A3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Famagusta) {.. {-9223372036854775808 8148 0 LMT}.. {-1518920148 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {622587

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Gaza

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8427
                                                                          Entropy (8bit):3.7517631589916043
                                                                          Encrypted:false
                                                                          SSDEEP:96:NyHSd2XK1GbJFp3gP0nPVl8dcqU/8O8pc1FlvaiSjxHe5PTisXNlDN3uMeVunBjq:NyyIgGbJv3dPAD7c1Flvai+4j/NKJ
                                                                          MD5:E539AE663A076DD9F1C6E927289DE5B1
                                                                          SHA1:855BCE0790A7259B01181861BCC748FE5F2815EB
                                                                          SHA-256:F030E2B3DBCA556C36602FBF234C7DB7D4F222D02CFAB192288E91E6A1BF3C90
                                                                          SHA-512:83E87396576A36455DF22EE809D71CBD18CDEC7F574A7AABFF6D5A21A71D2BE865B84105E2D72FD89F3C9AB19B66B6893F82934925E2311A8E6EAA015D6227F9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Gaza) {.. {-9223372036854775808 8272 0 LMT}.. {-2185409872 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-16580

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Harbin

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):179
                                                                          Entropy (8bit):4.86422571961583
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKwHp4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKi4wKU
                                                                          MD5:1BCCB3578FADE993EE8B2C11EAC06CD8
                                                                          SHA1:CAEAB714E014CD5040C44E4603708B97BC0B03D4
                                                                          SHA-256:12811A7944B892E3D1C0B4B09057CC1899F28081B3CD47FFD248BA49BA308AF0
                                                                          SHA-512:1D791DC0E8F45359366DF33C2C337688D2E0E972A90F038733B840D28585505AEF542DDBAD014C9EA8C252048A588CD017DD67A84545A81EDB7C17E3B2E65092
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Harbin) $TZData(:Asia/Shanghai)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Hebron

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8402
                                                                          Entropy (8bit):3.754379249421927
                                                                          Encrypted:false
                                                                          SSDEEP:96:fXSd2XK1GbJFp3gP0nPVl8dcqUZ8O8pc1FlvaiSjxHe5PTisXNlDN3uMeVunBj5w:fiIgGbJv3dPADPc1Flvai+4j/NKJ
                                                                          MD5:02B58C89D64C423A47559B2386FDAD1F
                                                                          SHA1:B01C4C83ACB44F454A593A510BCBB5A4068EC835
                                                                          SHA-256:2C126BA5F78CF7A13FBDFE00F647BB29E2AC104B89AB51B39281047D9B2E45A7
                                                                          SHA-512:BBF564FBBDF90091F4D97F3DCFA0F2AF1CE6EB6B0D24CE4F4133E098F7A637344A78BB27DD8160D8424148ECB46B7BF578959B15F9AA0AEAD5D080DCE7C9C176
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hebron) {.. {-9223372036854775808 8423 0 LMT}.. {-2185410023 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Ho_Chi_Minh

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):395
                                                                          Entropy (8bit):4.419283016412891
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862RLmdHqCv3tYC5sF/p+zHHviViksF/dMUYPsF/RQ9EsV:5debv3td5sFR+znv2vsFlM/PsFVsV
                                                                          MD5:5154581E724080F43C9D68B983C5CF77
                                                                          SHA1:1BC86A418AA654DA9EF73954DFD01ACF53D796E9
                                                                          SHA-256:FE977368691F4FA43D068CD8D989F39D2AEC46D199D7D629B8DD3ECF7423A335
                                                                          SHA-512:3708654E022919D5CDC2CA90D8623370CFFF248E3AF10ECCBB6F56BC7E8DD000E6119614C30678D6628BBE6A8CCA00746315108A04632B3F6DD2DE172BBF8956
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ho_Chi_Minh) {.. {-9223372036854775808 25600 0 LMT}.. {-2004073600 25590 0 PLMT}.. {-1851577590 25200 0 +07}.. {-852105600 28800 0 +08}.. {-782643600 32400 0 +09}.. {-767869200 25200 0 +07}.. {-718095600 28800 0 +08}.. {-457776000 25200 0 +07}.. {-315648000 28800 0 +08}.. {171820800 25200 0 +07}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Hong_Kong

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2226
                                                                          Entropy (8bit):4.0055033036300145
                                                                          Encrypted:false
                                                                          SSDEEP:48:5Ze9l9Pm4yoHtTYJJIX1Zcp6GS0j1SPQpP6gPE8fTZIPNYQGm75st/nQdwi9:DyaoTcwQt6EsQTng
                                                                          MD5:26BCBBA28AE34FE3CF7D17EF4C6B69C8
                                                                          SHA1:5324DEA8E7965C66650E7B4769EFA1297B508486
                                                                          SHA-256:EE9A6997BC1AAD4A8FA95DB312774C3F37FBB895549230C30FC66C02CC170EB6
                                                                          SHA-512:54594CD18838B4A8947EBB5BDE2415727CC127CF79AEC98FC0F5D5A32F68EEAF4E079853239DE9F753CE90F18EFD55AE51FC43D64E313666CEA0EF8AC93BF065
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hong_Kong) {.. {-9223372036854775808 27402 0 LMT}.. {-2056690800 28800 0 HKT}.. {-900910800 32400 1 HKST}.. {-891579600 30600 1 HKWT}.. {-884248200 32400 0 JST}.. {-761209200 28800 0 HKT}.. {-747907200 32400 1 HKST}.. {-728541000 28800 0 HKT}.. {-717049800 32400 1 HKST}.. {-697091400 28800 0 HKT}.. {-683785800 32400 1 HKST}.. {-668061000 28800 0 HKT}.. {-654755400 32400 1 HKST}.. {-636611400 28800 0 HKT}.. {-623305800 32400 1 HKST}.. {-605161800 28800 0 HKT}.. {-591856200 32400 1 HKST}.. {-573712200 28800 0 HKT}.. {-559801800 32400 1 HKST}.. {-541657800 28800 0 HKT}.. {-528352200 32400 1 HKST}.. {-510211800 28800 0 HKT}.. {-498112200 32400 1 HKST}.. {-478762200 28800 0 HKT}.. {-466662600 32400 1 HKST}.. {-446707800 28800 0 HKT}.. {-435213000 32400 1 HKST}.. {-415258200 28800 0 HKT}.. {-403158600 32400 1 HKST}.. {-383808600 28800 0 HKT

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Hovd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1583
                                                                          Entropy (8bit):3.7521760184466206
                                                                          Encrypted:false
                                                                          SSDEEP:24:5x3LecCvgsFFFKOksF8FpsF71FQnsFNFxhsFlF6sFaFasFZFisF8GF5sFKLFAZsZ:5FqKVx8Cq9f/y2L
                                                                          MD5:A77140A0D8C2D3E2993E4BA7CADFB4C6
                                                                          SHA1:AE3586264A86D42F578D4B0F7A30C9BE6047EAB1
                                                                          SHA-256:CA88A45E954A9854C680B399E69E4858BF5E861FABFADC19D62D97B734B25415
                                                                          SHA-512:05EA9D903EEC755F799B7C2399ED933245A5AE3A594648FE37AF1CE7699AE499B4ED159F428D91259D80BC9AF5117F2DA055A506AED94E5281C38B7AFF69C6FE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hovd) {.. {-9223372036854775808 21996 0 LMT}.. {-2032927596 21600 0 +06}.. {252439200 25200 0 +07}.. {417978000 28800 1 +07}.. {433785600 25200 0 +07}.. {449600400 28800 1 +07}.. {465321600 25200 0 +07}.. {481050000 28800 1 +07}.. {496771200 25200 0 +07}.. {512499600 28800 1 +07}.. {528220800 25200 0 +07}.. {543949200 28800 1 +07}.. {559670400 25200 0 +07}.. {575398800 28800 1 +07}.. {591120000 25200 0 +07}.. {606848400 28800 1 +07}.. {622569600 25200 0 +07}.. {638298000 28800 1 +07}.. {654624000 25200 0 +07}.. {670352400 28800 1 +07}.. {686073600 25200 0 +07}.. {701802000 28800 1 +07}.. {717523200 25200 0 +07}.. {733251600 28800 1 +07}.. {748972800 25200 0 +07}.. {764701200 28800 1 +07}.. {780422400 25200 0 +07}.. {796150800 28800 1 +07}.. {811872000 25200 0 +07}.. {828205200 28800 1 +07}.. {843926400 25200 0 +07}.. {859654800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Irkutsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2089
                                                                          Entropy (8bit):3.7296034934492694
                                                                          Encrypted:false
                                                                          SSDEEP:48:5PZy4DdOKStci4KjXoYjoSvfQJWE00dtT43kgiTskNrrBizhzRBqY3M:Py2/svfraBGfgP
                                                                          MD5:C9F7AC464970567E5C38CB01ED2297AE
                                                                          SHA1:453718BACCAE3FACD761AF22CA5875185478ADDD
                                                                          SHA-256:61BAAAD6315FFBDAED6F266880165B06ECCAF72F660B7FB01C8B654F3952D68E
                                                                          SHA-512:72044EFAE262CC12974F2DE2AAF06AC4C31BE73071ACD53DDC6B8D8BFC6FBDF937EC03DC881901F730659BDE662FBCFC76C57B2C086DAA97F160530464FBA7C6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Irkutsk) {.. {-9223372036854775808 25025 0 LMT}.. {-2840165825 25025 0 IMT}.. {-1575874625 25200 0 +07}.. {-1247554800 28800 0 +09}.. {354902400 32400 1 +09}.. {370710000 28800 0 +08}.. {386438400 32400 1 +09}.. {402246000 28800 0 +08}.. {417974400 32400 1 +09}.. {433782000 28800 0 +08}.. {449596800 32400 1 +09}.. {465328800 28800 0 +08}.. {481053600 32400 1 +09}.. {496778400 28800 0 +08}.. {512503200 32400 1 +09}.. {528228000 28800 0 +08}.. {543952800 32400 1 +09}.. {559677600 28800 0 +08}.. {575402400 32400 1 +09}.. {591127200 28800 0 +08}.. {606852000 32400 1 +09}.. {622576800 28800 0 +08}.. {638301600 32400 1 +09}.. {654631200 28800 0 +08}.. {670356000 25200 0 +08}.. {670359600 28800 1 +08}.. {686084400 25200 0 +07}.. {695761200 28800 0 +09}.. {701805600 32400 1 +09}.. {717530400 28800 0 +08}.. {733255200 32400 1 +09}.. {748

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Istanbul

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):187
                                                                          Entropy (8bit):4.9013773460609
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/2WFK4HB/8QaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/2wK4HJa
                                                                          MD5:8A92C690BE27A69D122BFF51479B7B56
                                                                          SHA1:52DB64587A347F34153A51788BDE8C349D966575
                                                                          SHA-256:1F77C4BD27574E1D2066885DEF01806A02D3E444424A219A8EC5C114F89665E5
                                                                          SHA-512:FEDF57C4862B6792A789F339EB1027EC8A8472B01B7D1D0814C419850B9AC03A7B454FDB04D8BECE166E9A8BCAA58B0B461007A6C824B30B1080991A1DB49CCA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Jakarta

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):370
                                                                          Entropy (8bit):4.4733192761103515
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKcrJfDm2OHATJeoHMaSYov/YSZkc5q/MVSSFFWSyvScH+dMVSSFL+:MB862EJLmdHjCEdOc5aMxaSyHHaMxF6P
                                                                          MD5:C689A1AA9FFE535AEB3AD3D7EDE55172
                                                                          SHA1:0520FC9A4619FB555A79C5DF2AE82422BF2C5EDA
                                                                          SHA-256:2F39D9F93761B85C254F458317A7DE2B4184BE9459F2193A85C08662E801269A
                                                                          SHA-512:C1034FB2FCFEF201C5362AF21B048B6637A824C5C93D75854CF3807892C772CD4376533E58BFF8D8726F531F43CB231365B8012EBD3C1BECED865D3CD2D6673D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jakarta) {.. {-9223372036854775808 25632 0 LMT}.. {-3231299232 25632 0 BMT}.. {-1451719200 26400 0 +0720}.. {-1172906400 27000 0 +0730}.. {-876641400 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 25200 0 WIB}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Jayapura

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):213
                                                                          Entropy (8bit):4.834345288972067
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKcaDm2OHG4YoH1kcfvScHVowkVcr2CV4zvhyov:MB862PmdHNYC6cfHHVop2NVkoov
                                                                          MD5:2CB3A13FCC48F8C4457E001FC309918B
                                                                          SHA1:83174176815CB93D216B5BC532C120EC8AC433CF
                                                                          SHA-256:761C1E80FEBF46D6D6215CEBF211F121974156D9BCE2FB4258C1074C6ED2CE22
                                                                          SHA-512:65009020AB9FEC2F8158A4851A78B71127F9B262DDD1472583942E19B7C086304F54BC8DAE5A40BD1448BCAEDA0FDBACCD19400E10FFA0357E324535F9036EF0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jayapura) {.. {-9223372036854775808 33768 0 LMT}.. {-1172913768 32400 0 +09}.. {-799491600 34200 0 +0930}.. {-189423000 32400 0 WIT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Jerusalem

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8135
                                                                          Entropy (8bit):3.770028446231146
                                                                          Encrypted:false
                                                                          SSDEEP:96:GKfnxFAEX/nPVl8diAg9oEhH20AHz7LzdWhYbBJPXuVhKaM76Rmg4DLeEcNptv5C:7ffBvPAzF0AHzPzdD1+XBRF0
                                                                          MD5:884227D48C92BA6C519BFE571D4F1037
                                                                          SHA1:21F8977816C2B439686A50D353B836A6D132A946
                                                                          SHA-256:0BDC2C693134199C2ECD374CC01468813DB29DF47422C706A3EA2BE5ECCA177A
                                                                          SHA-512:8A09F1FE11DAD203501A16FE6A2CAEC969FE3553B456B8BD1997E55B3EE430B2BB4B54F7D87C5E99931FD96E7C769CAA618C777EBD23FBD1E1A0F57409422914
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jerusalem) {.. {-9223372036854775808 8454 0 LMT}.. {-2840149254 8440 0 JMT}.. {-1641003640 7200 0 IST}.. {-933638400 10800 1 IDT}.. {-923097600 7200 0 IST}.. {-919036800 10800 1 IDT}.. {-857347200 7200 0 IST}.. {-844300800 10800 1 IDT}.. {-825811200 7200 0 IST}.. {-812678400 10800 1 IDT}.. {-794188800 7200 0 IST}.. {-779846400 10800 1 IDT}.. {-762652800 7200 0 IST}.. {-748310400 10800 1 IDT}.. {-731116800 7200 0 IST}.. {-681955200 14400 1 IDDT}.. {-673228800 10800 1 IDT}.. {-667958400 7200 0 IST}.. {-652320000 10800 1 IDT}.. {-636422400 7200 0 IST}.. {-622080000 10800 1 IDT}.. {-608947200 7200 0 IST}.. {-591840000 10800 1 IDT}.. {-572486400 7200 0 IST}.. {-558576000 10800 1 IDT}.. {-542851200 7200 0 IST}.. {-527731200 10800 1 IDT}.. {-514425600 7200 0 IST}.. {-490838400 10800 1 IDT}.. {-482976000 7200 0 IST}.. {-459388800 10800 1 I

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Kabul

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.8546989169864085
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFKTtNMXGm2OHodFxsYoHvgVHURRNVsRYovFFFkdj/cXHF:SlSWB9eg/2wKTPDm2OHoH+YoHvgVHURA
                                                                          MD5:9BD9B21661C235C0794078EC98978D3B
                                                                          SHA1:3D854780F49D0E5F5A190DC9367C7406127C5E4D
                                                                          SHA-256:A59C95C038F2E945D685D96FA9B859CE82A643A1B7F56EB36B2C809DE91CD4BA
                                                                          SHA-512:A76E99CF03DA8897F0A210A98DB79E4CD60070F2BE363D0D0960D9882919F9B49978FA55BB2500F1648ADD4080730CAD85BAFF61D885A9EAD394AC04C850F6BA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kabul) {.. {-9223372036854775808 16608 0 LMT}.. {-2524538208 14400 0 +04}.. {-788932800 16200 0 +0430}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Kamchatka

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2060
                                                                          Entropy (8bit):3.788131608921229
                                                                          Encrypted:false
                                                                          SSDEEP:24:5+SeWI/2kkWk7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5i/2ZsFLrcZwvJt2F+doTr9Q3G80
                                                                          MD5:390F39934F095F89358B73D056D90264
                                                                          SHA1:6B57CE5346B50ED88BFBB6BC57F834FB3F564905
                                                                          SHA-256:6E0278E389072437BC07A5032CD58E9E5B1B2BDB20918632C422EFA97BC43ABF
                                                                          SHA-512:6C54D94E95D73030F2FFCF8D130494CBD79FB1CEB9B59ADE0743C10F02557C3DD59CC6274B262A7E29C2D4C35DDA4B6A9A0398C661F5BD40F3B92181192B9577
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kamchatka) {.. {-9223372036854775808 38076 0 LMT}.. {-1487759676 39600 0 +11}.. {-1247569200 43200 0 +13}.. {354888000 46800 1 +13}.. {370695600 43200 0 +12}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965600 43200 0 +12}.. {764

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Karachi

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):457
                                                                          Entropy (8bit):4.396286144160272
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862dmdH35Cy6DvjeQXvjKEn6vNEhFc0bkTfb2iWToN1:5de3IjjeQ/jKE6vNNa8
                                                                          MD5:DF604BCD42A3C1E6BABD0E4FF5764CA3
                                                                          SHA1:984111F3A75EE7D8760AA2B839010545AF8EE359
                                                                          SHA-256:4E7F7ACAE8B4018A835328744F680C8054771805BB0BB07678A09737963C090D
                                                                          SHA-512:690AC3FC7CA3C66AA70F17E38C6B43FFACAB3F86040C3BA94FBFF80AC8C1AECF8192E503282109DABF3228F8DC73C732F1041C80455B8B26BDB25C4C32FA286A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Karachi) {.. {-9223372036854775808 16092 0 LMT}.. {-1988166492 19800 0 +0530}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 +0530}.. {-576135000 18000 0 +05}.. {38775600 18000 0 PKT}.. {1018119600 21600 1 PKST}.. {1033840800 18000 0 PKT}.. {1212260400 21600 1 PKST}.. {1225476000 18000 0 PKT}.. {1239735600 21600 1 PKST}.. {1257012000 18000 0 PKT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Kashgar

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):174
                                                                          Entropy (8bit):4.967143524972358
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8s4YkyXHAIgNrYOARL/2WFKu3e2WFKjov:SlSWB9vsM3yMGSHAIgvAN/2wKulwKjy
                                                                          MD5:259662F35AA09A891C2DDF8FCFECD6F0
                                                                          SHA1:DBB3A363A34C33F0B6B0D677E43C2985E2BAF976
                                                                          SHA-256:7B2251F0A41CBADF45D69F24604834167B14D8D33B510E635719AB404CABBCE2
                                                                          SHA-512:CD7E514555D58985C774535556B66542EFC5FB7CD5891F42FE21B591612CB7EBD4B41E96593E26E9283BA1B01EF3BE0FDFAE871F5EF6ADF2286AF1E479DCB44B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Urumqi)]} {.. LoadTimeZoneFile Asia/Urumqi..}..set TZData(:Asia/Kashgar) $TZData(:Asia/Urumqi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Kathmandu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.896398105471451
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFKXIi7hvXMXGm2OHF+VT5oHsQKwMTXvv6Q6zRk8P4VvW/:SlSWB9eg/2wKYghfDm2OH0T5oHxNMzv8
                                                                          MD5:7AC6429D2A08372C71C61B4521246FEC
                                                                          SHA1:6E50F5AD1018398491453D751F8B717B618EF46E
                                                                          SHA-256:F0A0816E62036637F75081CBF17A1E6B8FBC2D86AEC3CD2E234BBBDD6EC9F109
                                                                          SHA-512:A5389A318896ABCAFE419262F6B8CA86C917788F1E2AFBC8CB1C074A52870E7A92C9F6F7D79DDE4AB0D267D870D3CCD69B3FC5FD57520352EFE36C583B493FB9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kathmandu) {.. {-9223372036854775808 20476 0 LMT}.. {-1577943676 19800 0 +0530}.. {504901800 20700 0 +0545}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Katmandu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.8363583658476745
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8yIi7V5XHAIgN1AIilvWARL/2WFKSiZ1/2WFKXIi7y:SlSWB9vsM3y7gVJHAIg5QOAN/2wKSg15
                                                                          MD5:4CCC96293A33113D9ADC4130DCD19CBA
                                                                          SHA1:7BAB4B8DD6BB415A2FC86D9AB36BE2A893C03153
                                                                          SHA-256:9ACC9586B6F8B53BFE8B242283A434A9A9633D60559EBFDEE263B4C8915D50CA
                                                                          SHA-512:644E1777E01C15A728E30526F131462FCE50476A8FEDA9B99F41D95013BB8833A79437E75AA2025E2FD2E253B9AD40709DEF77E1F0C73DAAE7A9CF886A175A03
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kathmandu)]} {.. LoadTimeZoneFile Asia/Kathmandu..}..set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Khandyga

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2119
                                                                          Entropy (8bit):3.707911838150672
                                                                          Encrypted:false
                                                                          SSDEEP:48:5No6r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFYkRDhUBAc6l:r5PhtjLiII2JBC6c6l
                                                                          MD5:D7B394A9662D60D01781005FE73CC9E8
                                                                          SHA1:50B5EBD02596DC45D1F69358C5B69DD3058905FC
                                                                          SHA-256:33203D7FB7F3D1F848640ECE0642A2305E1863B4D47413075E2E7E40BD7418E7
                                                                          SHA-512:055EBA420F2F6049E803796ACCA263264B9E585E5312A86B8DF7B409C5F1CB1810F3AEDACD66CCF4605E55198947D263C240486C2A4D453D23C89802F0C66BBA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Khandyga) {.. {-9223372036854775808 32533 0 LMT}.. {-1579424533 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Kolkata

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):336
                                                                          Entropy (8bit):4.614218930153471
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKvhfDm2OHEX3gYoHrXdUvvYbQLpUFdvjSVVFJLNsR/QFckVVFJLLW:MB8623tmdHNYCDWXYbQtUTvjAJBs50vs
                                                                          MD5:248F1B5A26455000C936CE8BC02C1A0B
                                                                          SHA1:0C3F8CD4E038B113E5238AC52652809B6CA27999
                                                                          SHA-256:6D464564ED2EFC9DADA1586D4FC99FE333726D2BE15A00E30C2391F588896463
                                                                          SHA-512:AF36B0B3D410305ED504726C87265ACCAF5577A9B5DD7E7DAF135420E356C651287873197431B65B5317B4BA2009274288E4F101AC1274045A8D99E2414AB132
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kolkata) {.. {-9223372036854775808 21208 0 LMT}.. {-3645237208 21200 0 HMT}.. {-3155694800 19270 0 MMT}.. {-2019705670 19800 0 IST}.. {-891581400 23400 1 +0630}.. {-872058600 19800 0 IST}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 IST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Krasnoyarsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2062
                                                                          Entropy (8bit):3.7086418466382605
                                                                          Encrypted:false
                                                                          SSDEEP:24:5Ote2CoXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEw:5B40yVRB7VfXucydm46I/CTxwh
                                                                          MD5:A59F7FFD0C3EBAD47EC5F2B89EBBD9FA
                                                                          SHA1:ACB94E28E0CF7C6606086267CEA1F63A3E755F56
                                                                          SHA-256:53B8D5E7FB1BD67FECE66A933D9BDBB773F14A8C04D316A2A1B00EC6DBC151DD
                                                                          SHA-512:7B3886B9D0A793CCEEDB2B190523922CFEBE5C82A5201C9EFA30CA4C7F63FB75C998CC7E1BD48D5D489F16E36FC0C22BD954CB7D321B3C09B36B60629C4C9F7E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Krasnoyarsk) {.. {-9223372036854775808 22286 0 LMT}.. {-1577513486 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Kuala_Lumpur

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):375
                                                                          Entropy (8bit):4.4690470842439005
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wK1NSDm2OHroHvmdXjvWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScy:MB862PGmdHrCvovDTMsF/CFDMx/HHbMj
                                                                          MD5:5CFF42C943FFC92D16DACEB2872590A8
                                                                          SHA1:AEA8B1583764BE2AF7B055BC6AFAA0E486A2E35F
                                                                          SHA-256:25A8328B309B68DA85C7A800086A1E4D3C62B96AD97FEF24FC429A14C50E762B
                                                                          SHA-512:27800D0401E8D2028730B9664E9489B6A5182C394C2C05509E195D4471B4ABEFC26C82E9B818E94BD5578109728CD891FFE3C156248706A50D792D12A6CD8C96
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuala_Lumpur) {.. {-9223372036854775808 24406 0 LMT}.. {-2177477206 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Kuching

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):669
                                                                          Entropy (8bit):4.074079100812583
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKPLBDm2OHXoH3UTdMVSSFVM5qGeCiKaFzsBRcerUNwGvULhMXeiCs:MB862HL1mdHXC3UBMxJJo9rphTXUzHHF
                                                                          MD5:489E706324960E86B6E174D913C72E02
                                                                          SHA1:C7D77482C0D41F3426FC269B3B6C0575EF0E8C7E
                                                                          SHA-256:6E35E560675B0B5322474900D4EC8326C504788C1F82E533B09785DEEFF092DF
                                                                          SHA-512:5CEFD44656C041E59A16481E042EA914E7C003BDE6ADF5F49B57052E91F4F732A91A244BD8BC09EF5DC2640D3210DEE53882717C5C4CBD85CCE44A93B028E9C3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuching) {.. {-9223372036854775808 26480 0 LMT}.. {-1383463280 27000 0 +0730}.. {-1167636600 28800 0 +08}.. {-1082448000 30000 1 +08}.. {-1074586800 28800 0 +08}.. {-1050825600 30000 1 +08}.. {-1042964400 28800 0 +08}.. {-1019289600 30000 1 +08}.. {-1011428400 28800 0 +08}.. {-987753600 30000 1 +08}.. {-979892400 28800 0 +08}.. {-956217600 30000 1 +08}.. {-948356400 28800 0 +08}.. {-924595200 30000 1 +08}.. {-916734000 28800 0 +08}.. {-893059200 30000 1 +08}.. {-885198000 28800 0 +08}.. {-879667200 32400 0 +09}.. {-767005200 28800 0 +08}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Kuwait

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):173
                                                                          Entropy (8bit):4.877362838821003
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFKdQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKdQ6
                                                                          MD5:EA1DB4B80CC74CBA024B9BF3734B31F2
                                                                          SHA1:D8131C093BCA3B378BEC606CFEB56A40CB4E246F
                                                                          SHA-256:8E0C60A9AA64FB8602EDC35311F7436B04853970A21C1F6C871494A09AAD5787
                                                                          SHA-512:3B57C9CCC16AA4FE71D275D5EC6A7BC1838841023EE4408158362A7E13E7F1B345F7D95006BC8D2FC270158864E286A1A9364C792F679D5803BD82148399C199
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Kuwait) $TZData(:Asia/Riyadh)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Macao

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):169
                                                                          Entropy (8bit):4.781739054385376
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8PWXHAIgNz+NOARL/2WFKf+WFKkvn:SlSWB9vsM3yOHAIg1AN/2wKGwKmn
                                                                          MD5:55DAE27AEAA74FE822338C20B6CDFF68
                                                                          SHA1:F00EB827DC29EB2063B3A0EDBC39856637C55F33
                                                                          SHA-256:4308D741C83B263C7C9FB8EC692A7B7B502135E407B265B12EA7EF92523455C0
                                                                          SHA-512:398EE6015C58BDBBEAB49B74833B938FD84DE1AC6D3B8D095CE772ECA980D9E93F4EBFFFFCEAE7F91E287C8CE4F94B1A078D8E1460C352B7C2018F99915838FF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Macau)]} {.. LoadTimeZoneFile Asia/Macau..}..set TZData(:Asia/Macao) $TZData(:Asia/Macau)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Macau

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2217
                                                                          Entropy (8bit):3.9638741177777868
                                                                          Encrypted:false
                                                                          SSDEEP:24:5ReCX8Iv3nhPHCvzncCHg9PHjZzH+0HDHN1aHhHNaezHBjHeHsH65H18HDH983lY:5d8u3hfCTcaOrh6qn151Wf3Bogp+nlC
                                                                          MD5:B184E7403CB7168607D2C9E158F86A3B
                                                                          SHA1:48B003B8F822BE979FBCB08CBDBFFC617BCF99DB
                                                                          SHA-256:FBCB92CECB1CB0BC284ADC30D70C5F57B3AFC992136A0D898ABC64490BB700FB
                                                                          SHA-512:D8C5C67CAEB7C670B7BD1DACC1203C4DEE4DDB16A780F502C4440997CFCFF869E86842EF87C2CD0E0B942941C02A6BC3BDAB7CEAD78B026B68F4A031173400C8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Macau) {.. {-9223372036854775808 27250 0 LMT}.. {-2056692850 28800 0 CST}.. {-884509200 32400 0 +09}.. {-873280800 36000 1 +09}.. {-855918000 32400 0 +09}.. {-841744800 36000 1 +09}.. {-828529200 32400 0 +10}.. {-765363600 28800 0 CT}.. {-747046800 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716461200 32400 1 CDT}.. {-697021200 28800 0 CST}.. {-683715600 32400 1 CDT}.. {-667990800 28800 0 CST}.. {-654771600 32400 1 CDT}.. {-636627600 28800 0 CST}.. {-623322000 32400 1 CDT}.. {-605178000 28800 0 CST}.. {-591872400 32400 1 CDT}.. {-573642000 28800 0 CST}.. {-559818000 32400 1 CDT}.. {-541674000 28800 0 CST}.. {-528368400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-498128400 32400 1 CDT}.. {-478774800 28800 0 CST}.. {-466678800 32400 1 CDT}.. {-446720400 28800 0 CST}.. {-435229200 32400 1 CDT}.. {-415258200 28800 0 CST}.. {-403158600

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Magadan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2088
                                                                          Entropy (8bit):3.7643610103361134
                                                                          Encrypted:false
                                                                          SSDEEP:24:5he9dbbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKx/y:5wv+0j6lua2Gg/3gO8UoOZU2Wc/pKo
                                                                          MD5:F62A89F441C9C17EB99F64223C815651
                                                                          SHA1:408C38A79E056FF9B03D0DA85114DC015CB66938
                                                                          SHA-256:0C6EEEB7975A95C2B0678D137E6A735238D244A37FA11078050051511DE499FE
                                                                          SHA-512:55DC72546BDC26450D5318E9D2819E32A91C27D06A7AF5432BD50F8722C69984BBAA8599055A824D2935D919F0C0AA357687DD9B47F49F213EEE21AF7458FE17
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Magadan) {.. {-9223372036854775808 36192 0 LMT}.. {-1441188192 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Makassar

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):243
                                                                          Entropy (8bit):4.737440985553183
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wK5XDm2OHUVoHxYQTLQTvj1kc3gEpHkH8vScHr0:MB862hTmdHsCLTI6cQe7HHA
                                                                          MD5:9116C0B70AB33EC49F933EAE0238FD4B
                                                                          SHA1:BA390E8FBEAF5EA6E861AFC5A51CD4DF0B422461
                                                                          SHA-256:30D8AB00E32ECE51442C0310E650D89D6989E0809600EE334CB10C506D84BF9D
                                                                          SHA-512:499E60E8CBDA72226BCB4E241020E62B6F88E7D3E4329D260A6536EF87C02D7D61FD1BECC47D4FF308B4EB5D3E7FFBE2EC1C96FE2DEDC09DD1D973421C5FFE1E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Makassar) {.. {-9223372036854775808 28656 0 LMT}.. {-1577951856 28656 0 MMT}.. {-1172908656 28800 0 +08}.. {-880272000 32400 0 +09}.. {-766054800 28800 0 WITA}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Manila

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):421
                                                                          Entropy (8bit):4.48495488773916
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862GjmdHnCTZBCvEo6AwoucQzy4orjAbomAtoNv:5GjeCVwvB6AduXzylHAMmAa9
                                                                          MD5:0FBF0ED252638DF31826C33EB3FFBFE2
                                                                          SHA1:3496E4A5251A9BDF3AA4368297140780B6DBF66D
                                                                          SHA-256:070D61A0E39643A700ABA89A8A4BE5733BA456958966098405E11ECDFA854D76
                                                                          SHA-512:2A40E14964B357809E596DF88D8C4141ED78664BACA0A7724A7CA837EF427DC2B07C48D9DBE5787FAB0015673F5BDE002223D489334C5B91B74EEC5507A14B78
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Manila) {.. {-9223372036854775808 -57360 0 LMT}.. {-3944621040 29040 0 LMT}.. {-2229321840 28800 0 PST}.. {-1046678400 32400 1 PDT}.. {-1038733200 28800 0 PST}.. {-873273600 32400 0 JST}.. {-794221200 28800 0 PST}.. {-496224000 32400 1 PDT}.. {-489315600 28800 0 PST}.. {259344000 32400 1 PDT}.. {275151600 28800 0 PST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Muscat

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):170
                                                                          Entropy (8bit):4.805992552335358
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8DeXHAIgN6S7ARL/2WFKvE+H+WFKQ3n:SlSWB9vsM3yj+HAIgMS7AN/2wKLewKQ3
                                                                          MD5:8AEB5C3E81069F884A370714E8013F1F
                                                                          SHA1:4E3DD4A84627E75E84726C0CBA72CA6801280C2B
                                                                          SHA-256:011B7DE1C9F7EC241B224BC864D8AE66ACB433FBC8AD939E4DBEB12BE6390243
                                                                          SHA-512:50B1DE2615AE9B4781505DC709F9D07F6221D4E6D7B61D7BDA682377EAD9807F47FF0E933B79823D0DFD9F3647A82CFC28FB41FBB2226ED1D08B76F86FEB45DC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dubai)]} {.. LoadTimeZoneFile Asia/Dubai..}..set TZData(:Asia/Muscat) $TZData(:Asia/Dubai)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Nicosia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7625
                                                                          Entropy (8bit):3.7113086720696398
                                                                          Encrypted:false
                                                                          SSDEEP:96:R3pv/7V6Aj8aZaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:R3v/AauivBeRF+W35Syrwl9h5j
                                                                          MD5:2ADD0DFC1F133E4D044727234251A3DC
                                                                          SHA1:0D1502986258349E384017BA6CB8FA0AC424638C
                                                                          SHA-256:3C3E4844C70D361893EF022D6C3C8E38B243E91D40C5A726C924355476816F25
                                                                          SHA-512:70CDD53E7E44EDABF653A4F92EECBF5BB20A31DA95D65209D1CADE7DD9FC68946B8EC8829C28AE00BE5F42AAB545B9282CBBCFC5834437D6A94A179BF4FE0141
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Nicosia) {.. {-9223372036854775808 8008 0 LMT}.. {-1518920008 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {62258760

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Novokuznetsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2063
                                                                          Entropy (8bit):3.718004112421892
                                                                          Encrypted:false
                                                                          SSDEEP:24:526enddzXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFf:5l40yVRB7VfXucydm46I/CTxwf
                                                                          MD5:513B6A2AF76DAED9002C037BEC99862F
                                                                          SHA1:82D1C47BDF46B8B901C35BACACE8595C093BF5F2
                                                                          SHA-256:96A445D47D834C28480D1E2036ECA4962B35AFA494C219065D4879F71C1830DB
                                                                          SHA-512:2FE5AF4FA9D6AAB4FBD8E354789B82D39FA1B52394D3A0ABFBC6A30A531E0B7429A3D9AC7835A2843A6E9859E0255565F151FDFC87004ACB4EBD1AAD40BDA8A4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novokuznetsk) {.. {-9223372036854775808 20928 0 LMT}.. {-1441259328 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Novosibirsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2121
                                                                          Entropy (8bit):3.714792994893581
                                                                          Encrypted:false
                                                                          SSDEEP:24:52sve20ruXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnF:5Hc40yVRB7VfXu0TKmtTTDOWQ
                                                                          MD5:AC8C8D768503C8334A9FBAEF4C3A9CAB
                                                                          SHA1:CA10BB99E2D7AB329229759BD4801068A3AEB6D5
                                                                          SHA-256:EF799077291F6B3B19E0AEC88F224BB592FAAD09D30740F2376D3D20F2169639
                                                                          SHA-512:34049B1AC4254F999C3E5AD8CB31ABF88AC2D972E20E19927F33CC59935354F92125A0342A413E64227E8AE29DDFC2FFE5F67AE538C89D8EBAD7FCA889321DFA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novosibirsk) {.. {-9223372036854775808 19900 0 LMT}.. {-1579476700 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {738090000 25200 0 +07}.. {7

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Omsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2055
                                                                          Entropy (8bit):3.6912374223526396
                                                                          Encrypted:false
                                                                          SSDEEP:24:5abexPvO1FMnFP1FCnFHnFKqenFdDnFQgOnFxjPnFITnFonFJynFAT4TBThSv0FP:5asvjdqxph01NSvPETKmtTTDO0
                                                                          MD5:3E06B20B0B62AA09FA03082FAEE4FD62
                                                                          SHA1:8886EC80528ECA13D3364138BFFE92F881768169
                                                                          SHA-256:2605CD1E26E4AB48BCB4399BB5B17BAD115A47F87BA3DD54B55BB50C3FE82606
                                                                          SHA-512:04C1B6A898D12C8EA1B0B2F6665C870434061C63CC8F7A067BFC708E9828BA2E60104B82E2025E42D51DA2F485890C4D34EC0341EF466A7942649BE64F5EEE17
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Omsk) {.. {-9223372036854775808 17610 0 LMT}.. {-1582088010 18000 0 +05}.. {-1247547600 21600 0 +07}.. {354909600 25200 1 +07}.. {370717200 21600 0 +06}.. {386445600 25200 1 +07}.. {402253200 21600 0 +06}.. {417981600 25200 1 +07}.. {433789200 21600 0 +06}.. {449604000 25200 1 +07}.. {465336000 21600 0 +06}.. {481060800 25200 1 +07}.. {496785600 21600 0 +06}.. {512510400 25200 1 +07}.. {528235200 21600 0 +06}.. {543960000 25200 1 +07}.. {559684800 21600 0 +06}.. {575409600 25200 1 +07}.. {591134400 21600 0 +06}.. {606859200 25200 1 +07}.. {622584000 21600 0 +06}.. {638308800 25200 1 +07}.. {654638400 21600 0 +06}.. {670363200 18000 0 +06}.. {670366800 21600 1 +06}.. {686091600 18000 0 +05}.. {695768400 21600 0 +07}.. {701812800 25200 1 +07}.. {717537600 21600 0 +06}.. {733262400 25200 1 +07}.. {748987200 21600 0 +06}.. {76471200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Oral

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1664
                                                                          Entropy (8bit):3.708603813141953
                                                                          Encrypted:false
                                                                          SSDEEP:48:53PvalvNhQQvmRKqv0fvzQIovWdvEGvDaDv7w9hYwr:JHaBNKs6b03zB0WJEuDa77w9hYA
                                                                          MD5:A3BD0C15642AE4F001F98F8E060E8374
                                                                          SHA1:366F3C7FD4000AC23B79AB0FF4429371ED323B81
                                                                          SHA-256:933BBCD7AE0BF59A5B4A6E0EF74C237FEEDC42E6A3AEB2158131AA70FBA6FE47
                                                                          SHA-512:16D8692D3EA96D3594E6220A6989BBFBB926A66EEBEB240C4DC68BE75C69C5206659D9D341D92AE6128928FD38A5F45B445621CBBBA4E4BA8C34C3AC52BF3C08
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Oral) {.. {-9223372036854775808 12324 0 LMT}.. {-1441164324 10800 0 +03}.. {-1247540400 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {701816400 14400 0 +04}.. {701820000 18000 1 +04}.. {717544800 14400 0 +04}.. {733269600 18000 1 +04}.. {74899440

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Phnom_Penh

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.958543249401788
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKeHKLNM0WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKTNg
                                                                          MD5:EBF01E229CC41EB8B27650A3D668EDC1
                                                                          SHA1:33E1B252C1B45EAE326FCF8CC7C80C78A46F7E8D
                                                                          SHA-256:DCEE88876D00396918F43DECA421B6C9B02F84B5866A2CE16E641B814B390A9F
                                                                          SHA-512:80840600F37A256B8FD9933760FBAE7C13DE1E24EFD970E47BE8DEC731DFABF6D6FB76999BEEC775FF8C8B8719E94788ED7EEB04376A34C827ACB443F720F7E3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Phnom_Penh) $TZData(:Asia/Bangkok)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Pontianak

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):369
                                                                          Entropy (8bit):4.492596995768464
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKT5PDm2OHUeoH99xV/1kc5k/MVSSFFCLkvScH+dMVSSFL1CnF4mMz:MB862L5bmdHFCRV/6c5kMxGLkHHaMxFn
                                                                          MD5:9ADB1A9E41A143A06116E24EA0A53D90
                                                                          SHA1:6E50B549E1A705C0090BD5EDE26F7DED78CDF71A
                                                                          SHA-256:AC8370AEDF5FE3FE1E80710CE117DEE23815BE377D418E4B4F3259A1930E8DBF
                                                                          SHA-512:92790B20B960AC518AB2E18F902C6E0BA887F268909F5571CAC1068F5E719CCF6943AE6902DA1B683E170658B5E7BE06C6A187C1C0A652DD052D5BD0B2A7B84D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pontianak) {.. {-9223372036854775808 26240 0 LMT}.. {-1946186240 26240 0 PMT}.. {-1172906240 27000 0 +0730}.. {-881220600 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 28800 0 WITA}.. {567964800 25200 0 WIB}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Pyongyang

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):273
                                                                          Entropy (8bit):4.709411633376997
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wK8cE4SDm2OHnNoH9Aw8vmVuT0vjLtcjviov:MB8620cExmdHnNCGv2Ezv
                                                                          MD5:727BBC1A1662B500F616F544A484F213
                                                                          SHA1:93C1D902D9D4AA4197C7D16C61FB784AC01D0DE5
                                                                          SHA-256:29BA17F756F5C0BBA30FEBF44E620504D04921C832BD1CB56E1B60EF288B57DF
                                                                          SHA-512:C3C91E2F180109FF33E6491722F679A1B8DCE8CD31DE006D7FF2CBE270C008E927507C953641D28EE77D139BBEA54DEA1B7DBD6C30B208DDAB1B58756C32AC02
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pyongyang) {.. {-9223372036854775808 30180 0 LMT}.. {-1948782180 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-768646800 32400 0 KST}.. {1439564400 30600 0 KST}.. {1525446000 32400 0 KST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Qatar

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):176
                                                                          Entropy (8bit):4.851251407399968
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFKK3ovXMXGm2OHPFV4YoHsQKb3VvVsRYovFFF3FRVGsWr:SlSWB9eg/2wKK3yXDm2OHoYoHxcvSNFS
                                                                          MD5:CBA9635133F88AD3B27E23B95430C27C
                                                                          SHA1:5E41232EC03BBC71B522F58CB2D05E6BFFFF1A75
                                                                          SHA-256:18CCA69F933795CE3F7DB31506EFC063E6CE1DFDCAB32AA387C398456D7F7E1F
                                                                          SHA-512:D7C43F1F9ADA54C914ADB3CB2C9063EB7044089CFC7755ACFD08828CDEBA3C116AE2BE916ABE5D561E63699B921BC52636DD0BBC2C4304F813616D320D7DDAAF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qatar) {.. {-9223372036854775808 12368 0 LMT}.. {-1577935568 14400 0 +04}.. {76190400 10800 0 +03}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Qostanay

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1668
                                                                          Entropy (8bit):3.7299735983334195
                                                                          Encrypted:false
                                                                          SSDEEP:48:5DwvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQA:BMaBNKs6b03zB0WJEuDa7sFZiKWaN6TE
                                                                          MD5:F5DBE4E72FA5AB0019CC98C8E21EC86E
                                                                          SHA1:27ECB901AA07C18EA7F38235E8EFE0B1635FEFBC
                                                                          SHA-256:4191629B874C988291E8FD13E675A3ED685D677F6541313975FC4610E47F1DCD
                                                                          SHA-512:D5EFD4EFFFFE2E41909AEB7B67BD1FA6FAF4B8E9AC645518D5B33BD1B3C5084F59D47D4ED052E0D4B9F9989BDDBA3AECB3D1E67F5237914D24C01F9C95242396
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qostanay) {.. {-9223372036854775808 15268 0 LMT}.. {-1441167268 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {7489

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Qyzylorda

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1670
                                                                          Entropy (8bit):3.734572151642808
                                                                          Encrypted:false
                                                                          SSDEEP:48:5NvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWgvNSvTqvIQvyovklvqQX0:TaBNKs6b03zB0WJEuDa7sFZiKWcN6Tir
                                                                          MD5:026EC6E479EC006C4398288362254680
                                                                          SHA1:24AD03DD21DA394B3423D27211955BFD694F8E73
                                                                          SHA-256:CD6B067AA3EF6935B4E89CA36E6A03FCB97F1E0EE61A7B5D46C06BF4DE140774
                                                                          SHA-512:023AC55E118F13A31CE996C7BA155C90D47DEB6C223EEB3C0EE7B702871FF0CCA13CDF61D65FDDABE41B888CD7A74274AA5730059CC5688F8ED4DDBF8FE4ECA4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qyzylorda) {.. {-9223372036854775808 15712 0 LMT}.. {-1441167712 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {701812800 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Rangoon

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):174
                                                                          Entropy (8bit):4.812955128020714
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8nv3vXHAIgNnDA6RL/2WFK02KQMFfh4WFKsyn:SlSWB9vsM3yHvPHAIg15N/2wK0GEJ4wy
                                                                          MD5:BD3F294F1EDDD21467E980C9F5A0E7DE
                                                                          SHA1:11A3FC3E4489C18BDF9BFFB4C44615559D9DD99D
                                                                          SHA-256:E4D2C38D8E7377A528291A88129CDAC40CA4D40A5F1CD8ADB98228527556906E
                                                                          SHA-512:FA5FD600627793EABB83C1066BE246A47BCCE1FC57830596B9C0CDE8901B949AF178ABDE876C3B73CC3751312E8A4C03C390888B0B5A9669F511344143F83073
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Yangon)]} {.. LoadTimeZoneFile Asia/Yangon..}..set TZData(:Asia/Rangoon) $TZData(:Asia/Yangon)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Riyadh

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):148
                                                                          Entropy (8bit):4.973311159904374
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFK814PMXGm2OHFukeoHqUi9VssWYcv:SlSWB9eg/2wK81GDm2OHF7eoHvi9V1Wr
                                                                          MD5:AD3236CFF141732831732357AB181EE3
                                                                          SHA1:EAF51A63898A2048EA5FBE9BA4C001EEE37FFDB2
                                                                          SHA-256:411E31D09FFA48E44169C42661AE2F7FC142460BCAA216837D8C4740983CA7BD
                                                                          SHA-512:6CA2D89C02568580786BE98A863453ADCF4D21CAC52E5B44C4F7A05E76D29AEB3E28E353D6FB758BB553DBC8F35389462B388F61E94C68F5DB50A3E8C429336D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Riyadh) {.. {-9223372036854775808 11212 0 LMT}.. {-719636812 10800 0 +03}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Saigon

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.946090704619887
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8I65eV5XHAIgN2h6560ARL/2WFKwJ6h4WFK365ey:SlSWB9vsM3yJAVJHAIgA4k0AN/2wKl4i
                                                                          MD5:0766480A295525EE5D65F1ED32094858
                                                                          SHA1:7A2D68E1009DDD809A4A700931456C617DCD343A
                                                                          SHA-256:C695981A0DF691C3F4509999FBC52858ADC75024CCCBDEFBE1094FED17E809E4
                                                                          SHA-512:A21536FB61A64E953E8D6414FF0AEF1BC7E68A33C5DCF7090517A91FC449B96A93A4FBDF2C00682540D1193FDB29603349F5BDB455FD90045FDBCA61247A9860
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ho_Chi_Minh)]} {.. LoadTimeZoneFile Asia/Ho_Chi_Minh..}..set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Sakhalin

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2117
                                                                          Entropy (8bit):3.7276904131666577
                                                                          Encrypted:false
                                                                          SSDEEP:48:5q+3Vv+0j6lua2Gg/3gO8UoflcXRDhUBAc+:YxIa2GOT8tiXBC6c+
                                                                          MD5:295D51B8FBBE890C97637687B8F32322
                                                                          SHA1:7BB72B0EC783898DDF625D275E3BBB964D1693FB
                                                                          SHA-256:D7D0EA5CEF908442AB0D777A4B097BED18540CD5280FF63F33DD989E27E72908
                                                                          SHA-512:9B3E3BA01EAE38A00B0EE8A8FB17191CB4ED2EE9E46AE06403BA8C1193804764C86599840DC03E0C6A631456E1BE2BC560BDF6CF0450068EF78A6E494041326C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Sakhalin) {.. {-9223372036854775808 34248 0 LMT}.. {-2031039048 32400 0 +09}.. {-768560400 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Samarkand

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):879
                                                                          Entropy (8bit):3.9460497720710506
                                                                          Encrypted:false
                                                                          SSDEEP:24:5t8eZd7QvalvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKT10Sv6r:5MvalvNhQQvmRKqv0fvzQIovWdvEGvDO
                                                                          MD5:10A758996B0DF756E520541BEA9B7D75
                                                                          SHA1:137E5FD4E00CFA4B3939EF11868862B7F93D87CD
                                                                          SHA-256:35E4B905723891281D9A6A0A1FD3760A3A48136E1419C686BE31ACE83BF7AA9D
                                                                          SHA-512:7E32661731EAB2ED8C387533ACCB4853F5B6225BAC11E93247E7B06D7AA856E6A665F63718BFE395CFD00F80A4C16789D7097FFA8DAD88B1D707BF9C155C1D4C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Samarkand) {.. {-9223372036854775808 16073 0 LMT}.. {-1441168073 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Seoul

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):985
                                                                          Entropy (8bit):4.121802167517286
                                                                          Encrypted:false
                                                                          SSDEEP:24:5AemgvHzF+zg2c+z3NGmJhIUfqII8yHg/zoD:5F/nfWUBISHg/G
                                                                          MD5:A1DE6975DEA70D7241B5B3C43E1EA3AA
                                                                          SHA1:35EE563A2BCA77C761F7E878997763EA8D258040
                                                                          SHA-256:C4F82C94650572FE4D03BC1FE54CED8F4BF55DFBEE855D52DE3EA6378240AF93
                                                                          SHA-512:1639B0609115DBEA6A381986A732A5CA1523952AEF84843B4D714D5B2FF40B16C4166D8D60D31D4FC2C2BA34DED1F6DB39474336195603562265BDBF71687696
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Seoul) {.. {-9223372036854775808 30472 0 LMT}.. {-1948782472 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-767350800 32400 0 KST}.. {-681210000 36000 1 KDT}.. {-672228000 32400 0 KST}.. {-654771600 36000 1 KDT}.. {-640864800 32400 0 KST}.. {-623408400 36000 1 KDT}.. {-609415200 32400 0 KST}.. {-588848400 36000 1 KDT}.. {-577965600 32400 0 KST}.. {-498128400 30600 0 KST}.. {-462702600 34200 1 KDT}.. {-451733400 30600 0 KST}.. {-429784200 34200 1 KDT}.. {-418296600 30600 0 KST}.. {-399544200 34200 1 KDT}.. {-387451800 30600 0 KST}.. {-368094600 34200 1 KDT}.. {-356002200 30600 0 KST}.. {-336645000 34200 1 KDT}.. {-324552600 30600 0 KST}.. {-305195400 34200 1 KDT}.. {-293103000 30600 0 KST}.. {-264933000 32400 0 KST}.. {547578000 36000 1 KDT}.. {560883600 32400 0 KST}.. {579027600 36000 1 KDT}.. {592333200 32400 0 KST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Shanghai

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):981
                                                                          Entropy (8bit):4.16042656890735
                                                                          Encrypted:false
                                                                          SSDEEP:24:5Te3vvZJzHjwH6kHp7FH32AzHjZBHNHlQHuHxmHUjH6zHj2HBHeC:5ovZZO7lLpT24
                                                                          MD5:A266AA43A84FD5E4890BC77AA4E240D0
                                                                          SHA1:CD88C5D451CD7D3F50C9B36FDD47C84D20377441
                                                                          SHA-256:3AABB42D9EFE95D906B7F34640E7815919A1A20979EBB6EC1527FCAA3B09B22A
                                                                          SHA-512:13AE48F58C9AF24002F0FE4F28BF96B10EE0ED293E0DE9D29BCEBAAE102B2EA818F42CA4069544A254C95444A48604EC57E6AB2BEBDA4B5E72C82B49E61AD0A0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Shanghai) {.. {-9223372036854775808 29143 0 LMT}.. {-2177481943 28800 0 CST}.. {-1600675200 32400 1 CDT}.. {-1585904400 28800 0 CST}.. {-933667200 32400 1 CDT}.. {-922093200 28800 0 CST}.. {-908870400 32400 1 CDT}.. {-888829200 28800 0 CST}.. {-881049600 32400 1 CDT}.. {-767869200 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-650016000 28800 0 CST}.. {515527200 32400 1 CDT}.. {527014800 28800 0 CST}.. {545162400 32400 1 CDT}.. {558464400 28800 0 CST}.. {577216800 32400 1 CDT}.. {589914000 28800 0 CST}.. {608666400 32400 1 CDT}.. {621968400 28800 0 CST}.. {640116000 32400 1 CDT}.. {653418000 28800 0 CST}.. {671565600 32400 1 CDT}.. {684867600 28800 0 CST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Singapore

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):372
                                                                          Entropy (8bit):4.436676898144829
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKfbSDm2OHxdoHvm5vWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScHS:MB862nbGmdHDCvsvDTMsF/CFDMx/HHbe
                                                                          MD5:C3D13D921E4C6E475910E5080B761C32
                                                                          SHA1:8C5AE73C4098D03908E5D567FD7C4D827601D718
                                                                          SHA-256:05C76B58A4E356FD358E24FBC71FAE98DCB18C441C8D8CBB13A18D4F6E406062
                                                                          SHA-512:3A620597469D31577ECAAA098C95C244F0C288ABACE9E8964D8641154C1893967EFBD7211A41751D0D4CC1B0B9A2286F11738EFB7D01F110A4826BBE1844A2EA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Singapore) {.. {-9223372036854775808 24925 0 LMT}.. {-2177477725 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Srednekolymsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2064
                                                                          Entropy (8bit):3.7913177223006698
                                                                          Encrypted:false
                                                                          SSDEEP:24:5HJeidmbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxwy:5HSv+0j6lua2Gg/3gO8UoOZU2Wc/pKf
                                                                          MD5:B4FA38E884A85F6BD47C8BB02BB0500C
                                                                          SHA1:1DD135B79CC0D81C048D7B2C6BE0CF71171DD19E
                                                                          SHA-256:705D6D8360C2DCD51E909E39E1910FE876145220D151031612DA36B247207395
                                                                          SHA-512:2D32AAAF1BCC865B5F2810BFE0FB82BE98140BB5F2ECA1DA7FD148A3074DA127B81242F17B8BA9C9E259B61CBB123FD1513CCE6A85C8D7679ADFC0D689B552BB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Srednekolymsk) {.. {-9223372036854775808 36892 0 LMT}.. {-1441188892 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Taipei

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1344
                                                                          Entropy (8bit):4.062084847879695
                                                                          Encrypted:false
                                                                          SSDEEP:24:5X2eIvZPzGzHjZBHNHlQHKn3HnHNd9HiHkHBHaHLHMtyH9Qm+zHFOzHZ32HZvHiR:5Xi1ypBvt1mwO3Kq46T
                                                                          MD5:AECA800C8F2A679D0B19E5BB90AFD858
                                                                          SHA1:2C7DCEB709F9A4312C511971FE1E6A9DC1FBD0E8
                                                                          SHA-256:389C9D3EE2970665D0D8C5CB61B8B790C5FBDDC0DF0BF2B9753046F5953A477F
                                                                          SHA-512:C2D6BB4FEB5848D0704647D26F94C0BD8CD7E834AA2187EC9C877E80157E9CC225BBA3BECEE0148894C8639105D292AB50EE95830992BF357C632ACF001E020F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Taipei) {.. {-9223372036854775808 29160 0 LMT}.. {-2335248360 28800 0 CST}.. {-1017820800 32400 0 JST}.. {-766224000 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-639133200 28800 0 CST}.. {-620812800 32400 1 CDT}.. {-607597200 28800 0 CST}.. {-589276800 32400 1 CDT}.. {-576061200 28800 0 CST}.. {-562924800 32400 1 CDT}.. {-541760400 28800 0 CST}.. {-528710400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-497174400 32400 1 CDT}.. {-478688400 28800 0 CST}.. {-465638400 32400 1 CDT}.. {-449830800 28800 0 CST}.. {-434016000 32400 1 CDT}.. {-418208400 28800 0 CST}.. {-402480000 32400 1 CDT}.. {-386672400 28800 0 CST}.. {-370944000 32400 1 CDT}.. {-355136400 28800 0 CST}.. {-3394080

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Tashkent

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):878
                                                                          Entropy (8bit):3.9280321712564845
                                                                          Encrypted:false
                                                                          SSDEEP:24:5geQqdNRvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10Sv6r:5+EvdJqxiF0rvK50Sv6r
                                                                          MD5:DB59DB8E401E12917B7367D5604D3DE6
                                                                          SHA1:7CC7C5C1DB551BD381B833C81746201D36BC59A9
                                                                          SHA-256:4445F3F892C7267A6867009CC1A3F0B0548D0240408375A9D15360B28993C2A9
                                                                          SHA-512:2C7AE63C408A9F06F973AAC16845E1DBE92D15A421BBBE420914F21155AD5E57CD058D7E4427E43185E023D2FF475EBF9D74003ECEF004FF4E5F9D5681ADFB80
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tashkent) {.. {-9223372036854775808 16631 0 LMT}.. {-1441168631 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Tbilisi

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1729
                                                                          Entropy (8bit):3.6815162494646034
                                                                          Encrypted:false
                                                                          SSDEEP:24:5yBeqvIdZlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPqUsx9Ul4N:5MmsUf8mFpNWFnytO6VnYK
                                                                          MD5:C376C9ED66F6CC011E063D3E8E0DCED1
                                                                          SHA1:13C6345F8CB0EC79FE7C78B156C5737BCB66E49E
                                                                          SHA-256:B637BB0E49144C717E99E93540CB2C4D3695D63B91FE42547F2F0AA006498693
                                                                          SHA-512:FD60192CBEDC91C5D6B3B5E6F19DEDCAE14DCF48DCAE6D4865A8F0BBDC01CBF8DAAE92C4C46C353AF5B3EEE36CCC87B23F193DDF221132F5404C42507B708364
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tbilisi) {.. {-9223372036854775808 10751 0 LMT}.. {-2840151551 10751 0 TBMT}.. {-1441162751 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {694213200 10800 0 +03}.. {701816400 14400 1 +03}.. {717537600 10800 0 +03}.. {733266000 14400 1 +03}.. {748

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Tehran

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7250
                                                                          Entropy (8bit):3.5278500339429972
                                                                          Encrypted:false
                                                                          SSDEEP:96:z73zxgC3kvOR0xV1oLp9ZUj8nZjcJ5NIOFVp7ufbIL74f6IQTExJQtcAL:vryO2H1oLp9aQZyDmIVEPW
                                                                          MD5:359B270670A5FF61BBCE3D07F1BAA5AB
                                                                          SHA1:5B6D01C931D31D92299EE4455F76E69EB0C25A96
                                                                          SHA-256:A78655218A749F4ABCA436BE818E84D3277220FF3E69BE20A786AADF8AC744F9
                                                                          SHA-512:DFB0C7452AF6124A3742042CD97E7B9C0A84A4E338E00AF6DD66C971BC4D1324D3947A3A8601778F026E50367D942C10513FA1D73742E7006E91BF35E90260BF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tehran) {.. {-9223372036854775808 12344 0 LMT}.. {-1704165944 12344 0 TMT}.. {-757394744 12600 0 +0330}.. {247177800 14400 0 +04}.. {259272000 18000 1 +04}.. {277758000 14400 0 +04}.. {283982400 12600 0 +0330}.. {290809800 16200 1 +0330}.. {306531000 12600 0 +0330}.. {322432200 16200 1 +0330}.. {338499000 12600 0 +0330}.. {673216200 16200 1 +0330}.. {685481400 12600 0 +0330}.. {701209800 16200 1 +0330}.. {717103800 12600 0 +0330}.. {732745800 16200 1 +0330}.. {748639800 12600 0 +0330}.. {764281800 16200 1 +0330}.. {780175800 12600 0 +0330}.. {795817800 16200 1 +0330}.. {811711800 12600 0 +0330}.. {827353800 16200 1 +0330}.. {843247800 12600 0 +0330}.. {858976200 16200 1 +0330}.. {874870200 12600 0 +0330}.. {890512200 16200 1 +0330}.. {906406200 12600 0 +0330}.. {922048200 16200 1 +0330}.. {937942200 12600 0 +0330}.. {953584200 16200 1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Tel_Aviv

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.876713308636272
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/2WFK+TT52WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/2wKsswKR
                                                                          MD5:40B15013485EE2138A3DCB915F9121E7
                                                                          SHA1:3ADBE38686C7CA1FDE3DDD12BE908F39BFD1E228
                                                                          SHA-256:07537A30E6236D9E334DAFD5C4D352D25FDEF95D6DC7496F5D93EFAB74D9EBB1
                                                                          SHA-512:DA3B7B44B3BEF07CA8AA5253BF684A838181D8A15D7CCF0447A6B5F5BAE28D155CF65BCFB6286EB36C0B9F4FDD1FE862A3297ADB6FC33532B9F766334283D725
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Thimbu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):176
                                                                          Entropy (8bit):4.906503135441824
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8kNZ4WXHAIgNqFNKARL/2WFK9Z752WFKvNZovn:SlSWB9vsM3ykZ42HAIgc3KAN/2wKf126
                                                                          MD5:081862B6FB33389BEC9B0E6B500AA342
                                                                          SHA1:AF9467BB87C4C28921DF62A87B81223052F9FF4A
                                                                          SHA-256:37459C17B59639DF62B3F3943751902CE6AAF1F11B7630069DB45052EBEFB5B9
                                                                          SHA-512:CAF6F1C928528C4471229A2EF2944623545626532986628E6CE38884535286A0B38BA88C1A295E8B11322475D6BFAC61BF89786A76330C1A0C729339A3532BAF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Thimphu)]} {.. LoadTimeZoneFile Asia/Thimphu..}..set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Thimphu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.887493603495978
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFKvNZJMXGm2OHEQUTFnoHqVaJKuc/v6Q61V9gmZVFSTVV:SlSWB9eg/2wKVZJDm2OHEfnoHDKuc/SC
                                                                          MD5:F239452984CCA9F23E97A880652C39E6
                                                                          SHA1:52D25282D03B79960F152D21E7492EE26DAEBBAA
                                                                          SHA-256:B797C74E3840298C3CD8149FC8AA4BCE839EFE79E7C3310986FF23C965607929
                                                                          SHA-512:1044BEDAE04FCA7BD62937AFCE70F6C447583A90DD1596C3029A64A8251E3F73C106F4D940548DD38E895D67FEFDCD196B257E11437DEB399085EE80C345AA50
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Thimphu) {.. {-9223372036854775808 21516 0 LMT}.. {-706341516 19800 0 +0530}.. {560025000 21600 0 +06}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Tokyo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):388
                                                                          Entropy (8bit):4.470556147950505
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862ymdHOx5CvAoK3zoiIxtoFDIe+zT0agbov:5yeOCvARzzCOVa/gby
                                                                          MD5:3CCC15B63A882DB1B7459A51CD1C8165
                                                                          SHA1:77A3EFE6E4EE524B9EC6F51593DD7521FD7B8DAD
                                                                          SHA-256:3DA522FA88541A375D53F30A0B62DC4A305FA0315FEE534B7998C9E0A239450A
                                                                          SHA-512:15238E96DABAB5D2B9FFD25B3F50417ED32205FA69239D6F6B28DA97A378D669FD409164964D0DD2A5B1D795C8F60E8D4EB15924046348C3D6010646A536E07C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tokyo) {.. {-9223372036854775808 33539 0 LMT}.. {-2587712400 32400 0 JST}.. {-683802000 36000 1 JDT}.. {-672310800 32400 0 JST}.. {-654771600 36000 1 JDT}.. {-640861200 32400 0 JST}.. {-620298000 36000 1 JDT}.. {-609411600 32400 0 JST}.. {-588848400 36000 1 JDT}.. {-577962000 32400 0 JST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Tomsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2116
                                                                          Entropy (8bit):3.695316005718174
                                                                          Encrypted:false
                                                                          SSDEEP:24:5CeLz/XJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEno:5H040yVRB7VfXucydm4IqtTTDOS
                                                                          MD5:E95DE93CBCE72C5E02D7ECFE94C96308
                                                                          SHA1:59A49EBFE544D97545BADFEFE716BB5659C64C20
                                                                          SHA-256:6B64A01D0F0B5EC7A1410C3BD6883BA7CC133E9F073D40E8BFECE037E3A3FA24
                                                                          SHA-512:9E33DC9C1C6D60F3226263C484AF46A14AAB31F838516A0D69BA08F8F416EF10D09697E8D7ABAC1CE1F5BCE8AB0C2635D99FBE70C89ECC268DED0DCE89E67466
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tomsk) {.. {-9223372036854775808 20391 0 LMT}.. {-1578807591 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7647084

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Ujung_Pandang

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.897140749162557
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8pYFfXHAIgNzGRRL/2WFKPQOrFJ4WFKov:SlSWB9vsM3yWFPHAIg0RN/2wKPQOrFJD
                                                                          MD5:F6AE33D706C36FDD8A21F44AD59F5607
                                                                          SHA1:94D6EC7A437249AEBE2FA4AF8AFB029A620368C0
                                                                          SHA-256:732751845ACEDBFFD3C6170F4B94CB20B25BFDCFCC5EEA19F4BE439F5C5B573A
                                                                          SHA-512:2314AB2B154887842211C9A570BC1323D9B4375FF60C96296835DB001E8A277CA62D40B8562BC34EDDF281D96D5325640B79F7907558C6E0319C7D2A76BE239C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Makassar)]} {.. LoadTimeZoneFile Asia/Makassar..}..set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Ulaanbaatar

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1590
                                                                          Entropy (8bit):3.7728141273024374
                                                                          Encrypted:false
                                                                          SSDEEP:24:5IerIvusF7cCGK6zoCjZte3kzMjsBw0oZzlL98oysHqGzJvqE+ksabzdX+YjL:5VujmUCei46oljFC67
                                                                          MD5:A4647294401D2B54ABAA8E509BF05A6F
                                                                          SHA1:BF804CC38996D7715E3BA9BAD715D7ADBED781B9
                                                                          SHA-256:A56A26981163A717CF388A423CFE7A2BAD1BE8652BE2E338670CBC0C0A70E5E9
                                                                          SHA-512:B43157FABDE016FA6636CAB7B06CC1DEA53526B42FB46BB41DC4B7E48188D191C325BEF0D170B125E885F321C4316746A8D478D798828E2DC4A51C71DA4A610C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ulaanbaatar) {.. {-9223372036854775808 25652 0 LMT}.. {-2032931252 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 32400 1 +08}.. {433782000 28800 0 +08}.. {449596800 32400 1 +08}.. {465318000 28800 0 +08}.. {481046400 32400 1 +08}.. {496767600 28800 0 +08}.. {512496000 32400 1 +08}.. {528217200 28800 0 +08}.. {543945600 32400 1 +08}.. {559666800 28800 0 +08}.. {575395200 32400 1 +08}.. {591116400 28800 0 +08}.. {606844800 32400 1 +08}.. {622566000 28800 0 +08}.. {638294400 32400 1 +08}.. {654620400 28800 0 +08}.. {670348800 32400 1 +08}.. {686070000 28800 0 +08}.. {701798400 32400 1 +08}.. {717519600 28800 0 +08}.. {733248000 32400 1 +08}.. {748969200 28800 0 +08}.. {764697600 32400 1 +08}.. {780418800 28800 0 +08}.. {796147200 32400 1 +08}.. {811868400 28800 0 +08}.. {828201600 32400 1 +08}.. {843922800 28800 0 +08}.. {859

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Ulan_Bator

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):192
                                                                          Entropy (8bit):4.728285544456033
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8TcXkXHAIgNrfcXORL/2WFKhrMEBQWFKucXB:SlSWB9vsM3yXHAIgTN/2wKhrMEewKX
                                                                          MD5:D2EAEA6182FB332CAA707B523F6C8A9D
                                                                          SHA1:3BFC654E2B3BCF902AF41AEEC46772C84FFF3890
                                                                          SHA-256:D17FDAF17B3DAC3A1310E2332F61585598185E64CED799ABD68249EB5B698591
                                                                          SHA-512:E16BEE28BFE3AFFFE6F0025C09D0D65001F38D5045AAB1B554E4D3A66A88273F985B7BAA11F8D26E76E5ABC9F559E3E4B794CC939AAD5FF012A5A47924D08CB3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ulaanbaatar)]} {.. LoadTimeZoneFile Asia/Ulaanbaatar..}..set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Urumqi

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):149
                                                                          Entropy (8bit):5.006390440264841
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2WFKjhfMXGm2OHEVPoHsWA0GVFSTVVn:SlSWB9eg/2wKjJDm2OHEVPoH3A0CUX
                                                                          MD5:D6245CAAEC9BA2579F4CEFFF196A9369
                                                                          SHA1:4D182953F2CEEFF3583265F977B14F40C1A2FB43
                                                                          SHA-256:C445B8030DEDDDED0AFF5CC692CC323B63BE8C14BBD42DC3FDE90AD4F9D14785
                                                                          SHA-512:A32C477B6FAA79247907D1C4E2DF400B05AF4B529277C4CE12B33097872311E3F579115DC8CBA93DAC936928FD574414F3473A9CB7C8E85AB57CCA57489B60F8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Urumqi) {.. {-9223372036854775808 21020 0 LMT}.. {-1325483420 21600 0 +06}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Ust-Nera

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2058
                                                                          Entropy (8bit):3.773734429231407
                                                                          Encrypted:false
                                                                          SSDEEP:24:5petrlfgLv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxKG:5Ysv+0j6lua2Gg/3gO8UoOZU2Wc/pKF
                                                                          MD5:5ADD78E4AFCBA913D078A8790861A2DE
                                                                          SHA1:BB63A762D5D76C0FD3CB9AB2BCDE95718E1C99EB
                                                                          SHA-256:9D639C0FC69B3BEEBC96969092F9590EB48E7946E901B225BF245E165973B9A8
                                                                          SHA-512:7C2418FD1F96F101B83E2ABDF2551405C6E429DBBF30A2FA7CD2477E2CE1CEEBB790C51B28AEFF043BA7A7A914CEF3C812668058D69225B9FE9475C56508453D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ust-Nera) {.. {-9223372036854775808 34374 0 LMT}.. {-1579426374 28800 0 +08}.. {354898800 43200 0 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {764694000 43200 1 +12}.. {780418

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Vientiane

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):179
                                                                          Entropy (8bit):4.858039387006872
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKgTjEHp4WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKgsX
                                                                          MD5:D23A09C84A5368FBB47174BC0A460D14
                                                                          SHA1:045A72FEA79C75E5F0029BD110E33A022C57DFAB
                                                                          SHA-256:18F5E4FE8247F676278AC5F1912AC401DC48DF5B756D22E76FF1CFA702F88DA7
                                                                          SHA-512:404EABC2FC162E18C678CED063249C7FF4C28653880EA1903CE846FD191CD1C5B61E0610736F250B79BBAC768B1AFD6B9A8824D56D74591A95D7301B47D48387
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Vientiane) $TZData(:Asia/Bangkok)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Vladivostok

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2062
                                                                          Entropy (8bit):3.7094518963173035
                                                                          Encrypted:false
                                                                          SSDEEP:24:56beOUYQ7FyDy3le3i96VwAmnuBNuTw6vl9O8nfipRkwhUZDAcD:56cYQBIy343dVNUIukElcXRDhUBAcD
                                                                          MD5:5C0C094B088D0212182E7B944197D4FE
                                                                          SHA1:CF43A511FE9CD295207DF350704462E09D4D5278
                                                                          SHA-256:2558C96E25359C72F168DAC6FB3C16C54F8FD7D0724EEB1671156D4A1F42AC6C
                                                                          SHA-512:5D659EBDC8C2B06C964B083ECC78B4370A4658590D83F020CD23910C44E2D8DAFE69F61E8EB569E1905E89F38CD03ABE6B92F6CE36CF0B1EE0732A7645AFA65D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Vladivostok) {.. {-9223372036854775808 31651 0 LMT}.. {-1487321251 32400 0 +09}.. {-1247562000 36000 0 +11}.. {354895200 39600 1 +11}.. {370702800 36000 0 +10}.. {386431200 39600 1 +11}.. {402238800 36000 0 +10}.. {417967200 39600 1 +11}.. {433774800 36000 0 +10}.. {449589600 39600 1 +11}.. {465321600 36000 0 +10}.. {481046400 39600 1 +11}.. {496771200 36000 0 +10}.. {512496000 39600 1 +11}.. {528220800 36000 0 +10}.. {543945600 39600 1 +11}.. {559670400 36000 0 +10}.. {575395200 39600 1 +11}.. {591120000 36000 0 +10}.. {606844800 39600 1 +11}.. {622569600 36000 0 +10}.. {638294400 39600 1 +11}.. {654624000 36000 0 +10}.. {670348800 32400 0 +10}.. {670352400 36000 1 +10}.. {686077200 32400 0 +09}.. {695754000 36000 0 +11}.. {701798400 39600 1 +11}.. {717523200 36000 0 +10}.. {733248000 39600 1 +11}.. {748972800 36000 0 +10}.. {7

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Yakutsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2058
                                                                          Entropy (8bit):3.7081033128260934
                                                                          Encrypted:false
                                                                          SSDEEP:48:5h+r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2j:K5PhtjLiII2ZFlgm
                                                                          MD5:E43E5F0EA7C4575525BAB130984DCDCC
                                                                          SHA1:2D715749469FEA51A8E25D1F4F8DC4FF9178817D
                                                                          SHA-256:3BEF13638C46F16435D326C675907E61BB68C8173153CED3359E983BE0E413E5
                                                                          SHA-512:27954FEC865031BC363CFDE94E97B3B19836A6F777646EA4AAB12ECCAEE6D60A0C690711EA192B917AC717F94A01D1EF64BAE97DF968069CC12415971B070498
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yakutsk) {.. {-9223372036854775808 31138 0 LMT}.. {-1579423138 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {76470

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Yangon

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):244
                                                                          Entropy (8bit):4.692243303623333
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2wKs5XDm2OHGVQoHvZN6FCDx+UIFDVkvScHbY/s5UIAy:MB862KTmdHGuCvZNNkkHH3Sy
                                                                          MD5:D45766D30074719C9A88ACE8BB53204B
                                                                          SHA1:69B333DFCCCCEB66DD0F7DC28B272BB10769B6B0
                                                                          SHA-256:2526557810747E78E713AE09BC305621A80FAEECF8D441632E7825738D4C79CB
                                                                          SHA-512:5255DEED72D7D13862A4D6BED7E0458C099D2EF5A1B41536CAA7C0E65A61DE8B8D1AD62AD44559F970B6613ADFB3862778D1CC99B9A05CB5BBCA7F0202B5A5B2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yangon) {.. {-9223372036854775808 23087 0 LMT}.. {-2840163887 23087 0 RMT}.. {-1577946287 23400 0 +0630}.. {-873268200 32400 0 +09}.. {-778410000 23400 0 +0630}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Yekaterinburg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2095
                                                                          Entropy (8bit):3.704641905144701
                                                                          Encrypted:false
                                                                          SSDEEP:48:5ievNhYvm1qv7vXIovPvSvlDvtvuovKKvKcNvHvAvivBvqvvEyv8vlvEv+v4v+v+:/Nupj40H6l75FKCKcZP8qdyEaoBAWkW+
                                                                          MD5:D4DABA407BB8A10E4961D1DE5D9781D1
                                                                          SHA1:6933DE65336331BD90E2BEC6AEA0609B16DAEDC9
                                                                          SHA-256:2C78699EFC60758B8F8D0D1DEEDFDED5E65C65EBF3082B23E60BDEA8BF8FBCFE
                                                                          SHA-512:459E2187FAA66414F5CE934C335F563DFD2FA5316B86A54D1A29123A0460AFD65B7CE46629BD6A070A14CB6873A28A2F2803DE5FF4F29EA610712EB07FAD303F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yekaterinburg) {.. {-9223372036854775808 14553 0 LMT}.. {-1688270553 13505 0 PMT}.. {-1592610305 14400 0 +04}.. {-1247544000 18000 0 +06}.. {354913200 21600 1 +06}.. {370720800 18000 0 +05}.. {386449200 21600 1 +06}.. {402256800 18000 0 +05}.. {417985200 21600 1 +06}.. {433792800 18000 0 +05}.. {449607600 21600 1 +06}.. {465339600 18000 0 +05}.. {481064400 21600 1 +06}.. {496789200 18000 0 +05}.. {512514000 21600 1 +06}.. {528238800 18000 0 +05}.. {543963600 21600 1 +06}.. {559688400 18000 0 +05}.. {575413200 21600 1 +06}.. {591138000 18000 0 +05}.. {606862800 21600 1 +06}.. {622587600 18000 0 +05}.. {638312400 21600 1 +06}.. {654642000 18000 0 +05}.. {670366800 14400 0 +05}.. {670370400 18000 1 +05}.. {686095200 14400 0 +04}.. {695772000 18000 0 +06}.. {701816400 21600 1 +06}.. {717541200 18000 0 +05}.. {733266000 21600 1 +06}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Asia\Yerevan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2029
                                                                          Entropy (8bit):3.6487650030366106
                                                                          Encrypted:false
                                                                          SSDEEP:24:5O4GeuadYlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUUUl2ue/:5xKdsUf8mFpNWFnyLCPYmPJSi3sh4
                                                                          MD5:2CFA7C55D0731D24679CA5D5DC716381
                                                                          SHA1:2BB66783D75C71E76409365757980FBC15F53231
                                                                          SHA-256:20871FA6AA959DDFB73D846271B4A568627B564CFC08A11BDD84B98C2F2019A3
                                                                          SHA-512:CAB10A48859B2C0B2CC7C56E0AA530AE7E506A4986BADC5ED974D124BD46DB328B50C423F83FCFD52D31962A249EEFC10351798B86D51EDA500F412C8D42E6BC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yerevan) {.. {-9223372036854775808 10680 0 LMT}.. {-1441162680 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 10800 0 +03}.. {733273200 14400 1 +03}.. {748998000 10800 0 +03}.. {764722800 14400 1 +03}.. {780447

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Azores

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9879
                                                                          Entropy (8bit):3.557602151081988
                                                                          Encrypted:false
                                                                          SSDEEP:192:K35nZPOUYySoluItljncxelTMwtrayE6x5sETNek/CyNzybxYKmX6SXL/XbEcygI:K940pb6cL/b3Ldr9Q7TMq+ML
                                                                          MD5:E7F2A3EE0362E9ED3ECBAD24168AD098
                                                                          SHA1:98832274F6D9B641B809123D1272A1C04EEAA177
                                                                          SHA-256:6B3609BE4E93D21A2AB492594EDD387931E2C787E8471C9F2D3A677F34002D8F
                                                                          SHA-512:C48A76F8251AE455C759CB98802E40B3BEF716FD8E7441B6DE0242942C913367E3572B7C871082E97CA9BE67EC7DC37F8D01C438965217AC0EC36AD508DCE0D4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Azores) {.. {-9223372036854775808 -6160 0 LMT}.. {-2713904240 -6872 0 HMT}.. {-1830376800 -7200 0 -02}.. {-1689548400 -3600 1 -01}.. {-1677794400 -7200 0 -02}.. {-1667430000 -3600 1 -01}.. {-1647730800 -7200 0 -02}.. {-1635807600 -3600 1 -01}.. {-1616194800 -7200 0 -02}.. {-1604358000 -3600 1 -01}.. {-1584658800 -7200 0 -02}.. {-1572735600 -3600 1 -01}.. {-1553036400 -7200 0 -02}.. {-1541199600 -3600 1 -01}.. {-1521500400 -7200 0 -02}.. {-1442444400 -3600 1 -01}.. {-1426806000 -7200 0 -02}.. {-1379286000 -3600 1 -01}.. {-1364770800 -7200 0 -02}.. {-1348441200 -3600 1 -01}.. {-1333321200 -7200 0 -02}.. {-1316386800 -3600 1 -01}.. {-1301266800 -7200 0 -02}.. {-1284332400 -3600 1 -01}.. {-1269817200 -7200 0 -02}.. {-1221433200 -3600 1 -01}.. {-1206918000 -7200 0 -02}.. {-1191193200 -3600 1 -01}.. {-1175468400 -7200 0 -02}.. {-1127689

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Bermuda

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8784
                                                                          Entropy (8bit):3.833553120942514
                                                                          Encrypted:false
                                                                          SSDEEP:192:ZRBHksL3zq6bCvyjvspNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/+:ft0CC
                                                                          MD5:B04E22B9B42722013941169B5D04DEA2
                                                                          SHA1:32B96A7D9504D5022A6C4E2D310E95B5F062947F
                                                                          SHA-256:099C3BEFBA3B4C00AE19BC53D475A52B32FAC9B36EC823C8EAEFC7D00F78F388
                                                                          SHA-512:8B93BCA1E923B7A43F2EB0889216E8FF991D13CB8D25BD300310ED7CD8537DBD858E8F422C9B52AE2F52F7C1CB450EF0B7C5C1B3AE547C9C1E18E2A851569DD5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Bermuda) {.. {-9223372036854775808 -15558 0 LMT}.. {-2524506042 -15558 0 BMT}.. {-1664307642 -11958 1 BMT}.. {-1648932042 -15558 0 BMT}.. {-1632080442 -11958 1 BMT}.. {-1618692042 -15558 0 BST}.. {-1262281242 -14400 0 AT}.. {-882727200 -10800 1 ADT}.. {-858538800 -14400 0 AST}.. {-845229600 -10800 1 ADT}.. {-825879600 -14400 0 AST}.. {-814384800 -10800 1 ADT}.. {-793825200 -14400 0 AST}.. {-782935200 -10800 1 ADT}.. {-762375600 -14400 0 AST}.. {-713988000 -10800 1 ADT}.. {-703710000 -14400 0 AST}.. {-681933600 -10800 1 ADT}.. {-672865200 -14400 0 AST}.. {-650484000 -10800 1 ADT}.. {-641415600 -14400 0 AST}.. {-618429600 -10800 1 ADT}.. {-609966000 -14400 0 AST}.. {-586980000 -10800 1 ADT}.. {-578516400 -14400 0 AST}.. {-555530400 -10800 1 ADT}.. {-546462000 -14400 0 AST}.. {-429127200 -10800 1 ADT}.. {-415825200 -14400 0 AST}.. {1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Canary

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6856
                                                                          Entropy (8bit):3.8064107143060752
                                                                          Encrypted:false
                                                                          SSDEEP:96:KXVuHfXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:KXVQbkIaFF1w0us4qE3+sSGjT
                                                                          MD5:8ABD279386C50705C074EEE18BF5AE59
                                                                          SHA1:C392231DBE744F5942DA4BFAC8AD0ABEBAEA0BF3
                                                                          SHA-256:2026944DCDEBC52F64405E35119F4CF97EA9AA1E769498730880B03F29A2B885
                                                                          SHA-512:3095759D01AC7EEA25E427CA38E8A0395BEFA7250E7A0C1327BF9D61F07F4570CDF7313FBE6695973EB0DD66D201C6C63591CC0DA8A1E0029926DC7056F4C95B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Canary) {.. {-9223372036854775808 -3696 0 LMT}.. {-1509663504 -3600 0 -01}.. {-733874400 0 0 WET}.. {323827200 3600 1 WEST}.. {338950800 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Cape_Verde

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):246
                                                                          Entropy (8bit):4.637993677747699
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/2RQ7RfDm2OHDoH1JlvQV/FFrR3FcykVvQV/FFf+nmwV:MB86267RLmdHDC1w/FH3FcyL/FomwV
                                                                          MD5:1581C6470850E0C9DB204975488B1AF8
                                                                          SHA1:6933ED13F18AD785CEDF0837F86EFAC671297A85
                                                                          SHA-256:2EA59ACDB5BBDD3C6ABCEEA456838A5CA57371A3D2BB93604B37F998ED8B9D4D
                                                                          SHA-512:9FFFA013D82CEFF6F447521C19270ECDD71152F23670164423E6013FEC46253C62D2CB79B42630BD786BD113F27369E746CA981DD17E789F7571F473B47247C1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Cape_Verde) {.. {-9223372036854775808 -5644 0 LMT}.. {-1830376800 -7200 0 -02}.. {-862610400 -3600 1 -01}.. {-764118000 -7200 0 -02}.. {186120000 -3600 0 -01}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Faeroe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.709193799640151
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqLG4E23vXHAIgvMG4EeRRL/2RQqG4EZrB/4RQqG4E1n:SlSWB9vsM3yCPHAIgvoRN/2RQ1rB/4Ri
                                                                          MD5:601EB889A87F9CAD6F1DF4D1AB009FAE
                                                                          SHA1:EB43C253A48755442A67A2408D7E3295549F831C
                                                                          SHA-256:64FB8CAD17CD36666C7027AAD01344FEF659B13699EEF1942365842F8ED2170E
                                                                          SHA-512:9CFC4A446ED6A3BEF6C26AE57324F10A970EE2ADD6933130447FAD6A3DB538841F2490DD461AF5776FACD9BD2CDC4A83247DFA6B34802AE844DDC6D4C37B28EA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Atlantic/Faroe)]} {.. LoadTimeZoneFile Atlantic/Faroe..}..set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Faroe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6796
                                                                          Entropy (8bit):3.804838552487436
                                                                          Encrypted:false
                                                                          SSDEEP:96:96ufXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:/bkIaFF1w0us4qE3+sSGjT
                                                                          MD5:F97CC7EB9C52D00177BFF4715832FCD5
                                                                          SHA1:CD9DCBB5E6ADD6EA91C8F142957EC229FC7F6DA3
                                                                          SHA-256:795F438E7F01342D5F25ECCDD09FCE65C03C5D2D561B9B5191301D57EC16B850
                                                                          SHA-512:9586289FEB6C597160011A47432F0AC40000483FA2E579BD89046EFD33E98DDAD652B792FD80CEDEB4CD87B6439A7B473F25F1B7375BC75353CBAF9F77E1084E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Faroe) {.. {-9223372036854775808 -1624 0 LMT}.. {-1955748776 0 0 WET}.. {347155200 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600 3600 1 WEST}.. {811904400 0 0 WET}.. {828234000 3600

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Jan_Mayen

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.975859213900122
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVyWJooeyXHAIgoqxWJz5RL/2RQqG0EHEcAg/h8Qas:SlSWB9vsM3ymSDSHAIgoXN/2RQaK8Avn
                                                                          MD5:6EB1E51CDB90E841DC151004E98E80CF
                                                                          SHA1:CDB1FFF4FDBC7837E10E3725F09626345A82716E
                                                                          SHA-256:9152D10450CEBCE4AAEA3F3C8A50E4077A881E0B06B193A5886F06A453803112
                                                                          SHA-512:252648AA76AC0F08ED9BA3CB82E930101B1D2CE37EA979670671909CA8E2C7D838C35A449B0C7C2EF7BBF08C746475EC83403651CFB203E2F56C395CE2640933
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Oslo)]} {.. LoadTimeZoneFile Europe/Oslo..}..set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Oslo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Madeira

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9709
                                                                          Entropy (8bit):3.80455694200614
                                                                          Encrypted:false
                                                                          SSDEEP:192:hZUiLbMsf/ss0qKd+aKyUXtOZHY1SCOcesoQivoKbFVCdm1rXWNXyCXTOuUbkIaq:hZZDQX1rWJysukysLE3+sSGjT
                                                                          MD5:AC6647F9B53B5958214EC3F3B78A4D85
                                                                          SHA1:7355622AF99296F069F73899D5C70941C207F676
                                                                          SHA-256:B2A0D0DDC26806A05B2BE806CA3F938DB12A3FA40110B8B21FD3F04EFED3A531
                                                                          SHA-512:07569CA4D5DC6D57D91D6FDC370671A7546B73BA653D094E1B501D33570F7700727AD7FF2A083BC79E9EDE807C47E7A5604BEF5803F290B2F277C51DEF10FA6B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Madeira) {.. {-9223372036854775808 -4056 0 LMT}.. {-2713906344 -4056 0 FMT}.. {-1830380400 -3600 0 -01}.. {-1689552000 0 1 +00}.. {-1677798000 -3600 0 -01}.. {-1667433600 0 1 +00}.. {-1647734400 -3600 0 -01}.. {-1635811200 0 1 +00}.. {-1616198400 -3600 0 -01}.. {-1604361600 0 1 +00}.. {-1584662400 -3600 0 -01}.. {-1572739200 0 1 +00}.. {-1553040000 -3600 0 -01}.. {-1541203200 0 1 +00}.. {-1521504000 -3600 0 -01}.. {-1442448000 0 1 +00}.. {-1426809600 -3600 0 -01}.. {-1379289600 0 1 +00}.. {-1364774400 -3600 0 -01}.. {-1348444800 0 1 +00}.. {-1333324800 -3600 0 -01}.. {-1316390400 0 1 +00}.. {-1301270400 -3600 0 -01}.. {-1284336000 0 1 +00}.. {-1269820800 -3600 0 -01}.. {-1221436800 0 1 +00}.. {-1206921600 -3600 0 -01}.. {-1191196800 0 1 +00}.. {-1175472000 -3600 0 -01}.. {-1127692800 0 1 +00}.. {-1111968000 -3600 0 -01}.. {-

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Reykjavik

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2035
                                                                          Entropy (8bit):3.716074665066009
                                                                          Encrypted:false
                                                                          SSDEEP:48:5Fhytu1phYdTclBoLB+Q1utqZu97fKnt91ItLjxkRq2fE4/JQjJuj4csf5J1R8yO:jhytu1phYdTclBoLB+Q1utqZuZfKt91x
                                                                          MD5:FE3467015B8B226CB9D8077CB1ABF81B
                                                                          SHA1:665083E753C6860755D669F30DF55333F2740127
                                                                          SHA-256:E77B9D50AF6C2550CA0517B4A6DE64A8A159AD0C77F1294C4212B6E20221B099
                                                                          SHA-512:661CA9C1DEDB9CE459215C48AE1409787B39EA025DA897FE8DA5532966FEC28BF86DF4B2794F7DDACFC01064CB9A11737592018C9B5C05045934D237FB1C428B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Reykjavik) {.. {-9223372036854775808 -5280 0 LMT}.. {-1956609120 -3600 0 -01}.. {-1668211200 0 1 -01}.. {-1647212400 -3600 0 -01}.. {-1636675200 0 1 -01}.. {-1613430000 -3600 0 -01}.. {-1605139200 0 1 -01}.. {-1581894000 -3600 0 -01}.. {-1539561600 0 1 -01}.. {-1531350000 -3600 0 -01}.. {-968025600 0 1 -01}.. {-952293600 -3600 0 -01}.. {-942008400 0 1 -01}.. {-920239200 -3600 0 -01}.. {-909957600 0 1 -01}.. {-888789600 -3600 0 -01}.. {-877903200 0 1 -01}.. {-857944800 -3600 0 -01}.. {-846453600 0 1 -01}.. {-826495200 -3600 0 -01}.. {-815004000 0 1 -01}.. {-795045600 -3600 0 -01}.. {-783554400 0 1 -01}.. {-762991200 -3600 0 -01}.. {-752104800 0 1 -01}.. {-731541600 -3600 0 -01}.. {-717631200 0 1 -01}.. {-700092000 -3600 0 -01}.. {-686181600 0 1 -01}.. {-668642400 -3600 0 -01}.. {-654732000 0 1 -01}.. {-636588000 -3600 0 -01}.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\South_Georgia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):160
                                                                          Entropy (8bit):5.011466665416709
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/2RQqGtlN62/EiMXGm2OHXT14YoHvhFvdQVIyV:SlSWB9eg/2RQrlo2MiDm2OHXqYoHvTFS
                                                                          MD5:3B310BB8C90CA716DC1AC5A697ACA9CD
                                                                          SHA1:CD583F49478DCDAD91EF78539502C6FC62945C1E
                                                                          SHA-256:51BFABCB3388107753A3C1A8CF31118E6627132BAA09B9878D9E7CEDBEBB4886
                                                                          SHA-512:F593B7A1FAF0EA6B42D5EE86C20C9A8F5CD7ACD9B30EF7755E45ECAFEA8752C32E4CF4BEDF531F494E59D9F0C49CCC6FCA077292E20794AA265DFC0A56DFE579
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/South_Georgia) {.. {-9223372036854775808 -8768 0 LMT}.. {-2524512832 -7200 0 -02}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\St_Helena

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.880390141563645
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2RQqGt4r+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2RQr4rV
                                                                          MD5:2C73A963F515376A46762CE153AAF5C5
                                                                          SHA1:996C3C93DFAD89EA80AC5DFA1DFBD7CECD9ED28D
                                                                          SHA-256:1C9CA8966FC8BD0BE70F4A187E17E56FB99139BC88C392E82BA2E23E23111C54
                                                                          SHA-512:35A9ADC047DB058D71C21FC4ECB57CD14B0D9BA4416506763D1800D72CE6C9E81636F332AAD3533616F05C86F90A60416BD4065C5F832A51AA3DC186218BDCAE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Atlantic/St_Helena) $TZData(:Africa/Abidjan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Atlantic\Stanley

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2256
                                                                          Entropy (8bit):3.662522763865322
                                                                          Encrypted:false
                                                                          SSDEEP:48:506KSBSdSs2SbSwGSyPU3lSsS5SGScSo/SkSuShSceS3SBSc7XSiSgSwSd/SJkS6:JKU+Ew0FU1TuhrR//tOIoOjXZfDWSkPR
                                                                          MD5:77C7ECE4FCBE150069B611C75E8DAA0E
                                                                          SHA1:22F4E5F15BCA92D8456B70BB36230F2605CA5E1C
                                                                          SHA-256:F0E99EF01F140CD5AAFE16803A657922207E6F7F6AF10B0AE795790916C302C4
                                                                          SHA-512:6FB57E8499A587292AFAFA9BD003721572393D5268CAF956230DA76983A112B27D6731BE561A22CCEF84935F43AC988B667C2DC404C157EA8D0E7830FC1A2AB8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Stanley) {.. {-9223372036854775808 -13884 0 LMT}.. {-2524507716 -13884 0 SMT}.. {-1824235716 -14400 0 -04}.. {-1018209600 -10800 1 -04}.. {-1003093200 -14400 0 -04}.. {-986760000 -10800 1 -04}.. {-971643600 -14400 0 -04}.. {-954705600 -10800 1 -04}.. {-939589200 -14400 0 -04}.. {-923256000 -10800 1 -04}.. {-908139600 -14400 0 -04}.. {-891806400 -10800 1 -04}.. {-876690000 -14400 0 -04}.. {-860356800 -10800 1 -04}.. {420606000 -7200 0 -03}.. {433303200 -7200 1 -03}.. {452052000 -10800 0 -03}.. {464151600 -7200 1 -03}.. {483501600 -10800 0 -03}.. {495597600 -14400 0 -04}.. {495604800 -10800 1 -04}.. {514350000 -14400 0 -04}.. {527054400 -10800 1 -04}.. {545799600 -14400 0 -04}.. {558504000 -10800 1 -04}.. {577249200 -14400 0 -04}.. {589953600 -10800 1 -04}.. {608698800 -14400 0 -04}.. {621403200 -10800 1 -04}.. {640753200 -14400 0 -

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\ACT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.862270414049974
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjpMFBx/h4QWCCj1:SlSWB9vsM3yI9kHAIgmON/2DCeMFB/4d
                                                                          MD5:2EF41863430897F45E0CBB51E6A44069
                                                                          SHA1:8E9561060E9509FAF235E5E033FC9C2918E438DB
                                                                          SHA-256:DF7CBDDCBB2F5926A07D19A35739E5B8DCD9733C037F7D1FF95753C28D574674
                                                                          SHA-512:9D3A37D64DCCCA28093C30FAB595690D021FACEC15F351A77CA33A779D645D305A2FA031869F0DE3B0404C498C2C321D3D02E4DC592D3C632F6700F5DCB54900
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/ACT) $TZData(:Australia/Sydney)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Adelaide

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8372
                                                                          Entropy (8bit):3.894755849491153
                                                                          Encrypted:false
                                                                          SSDEEP:96:j8SY62BXovlCyRL8pJXa4NyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:j8X3Xzgl3PaN8asiQ/Uv9UnvtCaRs
                                                                          MD5:94E1A0C4326D09AF103107E64625CC6C
                                                                          SHA1:C026565F020EB158309549D98313632BAA79205F
                                                                          SHA-256:5C43D3152982BCFD5B9F51D0E909CF3A558BED1C270FEFFE030531D38D6F91B7
                                                                          SHA-512:CA08A8BC0EB740D59650FE0A9E56D9E169348AD0994F2BFFD6CCFBF9CC42E82F892FB719E80C4E2084B5702E9725C651359EE3066BD71BB19397EA83B6A68430
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Adelaide) {.. {-9223372036854775808 33260 0 LMT}.. {-2364110060 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1 ACDT}.. {320776200 34200 0 ACST}

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Brisbane

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):674
                                                                          Entropy (8bit):4.32071371733564
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862ELmdHLOYCvSi0xT0ryRIvUr0obZv:5ELe6dvSi6L
                                                                          MD5:900B39F1D4AB93A445F37B6C0A8DE3D9
                                                                          SHA1:DE82800779DCB8094C395B5024BD01FFA3C3BB8C
                                                                          SHA-256:0D3C39EDAB34A8DB31A658A1549772F7D69EB57565E40AA87B707953A2D854A4
                                                                          SHA-512:8D115D1D14FE6FF21A4AE77E3AAC075E6A877214E568956B9A4FD2E75A46E458CAA5AE26B483F128B4C62960D73BD7543BC32F22B760059423B3D9ABCBA24B6A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Brisbane) {.. {-9223372036854775808 36728 0 LMT}.. {-2366791928 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Broken_Hill

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8437
                                                                          Entropy (8bit):3.902306256303896
                                                                          Encrypted:false
                                                                          SSDEEP:96:QZSSY62BXovldRL8q75aANyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:QZSX3X2QfPaN8asiQ/Uv9UnvtCaRs
                                                                          MD5:1553DAAB804A6C9BB15D711554980D3B
                                                                          SHA1:5E3161B1FBB4C246DCB5E11ABD94095121CE38ED
                                                                          SHA-256:734F295BD0B558BDF6178DE62151B8913699D08AB2B1D101C55B8DEBC410074C
                                                                          SHA-512:06B21886070E39E390ECBD18841B7FDBFCA2C7C8573495D2BAA2B92EB113CD1C73C18D73C49DE3C49572CBCBCBED2FAD3248BC651BEB825A1E089B1DEDEFCBFA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Broken_Hill) {.. {-9223372036854775808 33948 0 LMT}.. {-2364110748 36000 0 AEST}.. {-2314951200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Canberra

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):195
                                                                          Entropy (8bit):4.851279484907769
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjnSV1+QWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DCcq+DCyB
                                                                          MD5:8944D3DF8FBECC03A8FB18C3B2DA3B53
                                                                          SHA1:6B17B38D6560592CA49840C47DB9BDA7E79F9F76
                                                                          SHA-256:5FE3CED97293FE0573D5ECE0CEF59CE5DDB4C57BC568AE7199E77B01D3ADE17C
                                                                          SHA-512:907D8BB7EA840E0B3AC683884F2F709A2C06D67CE9258BE46400A0DA63581A9B1403A44FA43E1059BE8F5C7E06F9FA05C176309AD6295317BF14F0E9FA5741E4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/Canberra) $TZData(:Australia/Sydney)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Currie

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):193
                                                                          Entropy (8bit):4.79231670095588
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DCkx+4DCVDy:MByMjUQVv8At2s4Ky
                                                                          MD5:0C1DFC0877CE8EB08007B7C2B7AF2D87
                                                                          SHA1:02F835BE2DA4FCA79DC2A6959BB4EB6ACC8DF708
                                                                          SHA-256:1DD4EC4ED4F854E2EF6162B2F28C89208710F8EC5AABB95FFA9425D3FBBCAB13
                                                                          SHA-512:358347045915B7D10940DB15E49528D0C636BEC1BE70129847D0B9D034F9E96E847394D88358E87D98A9E581605A3C2AB917B85FDE1296F290B4194BB7E3FA46
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Currie) $TZData(:Australia/Hobart)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Darwin

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):437
                                                                          Entropy (8bit):4.508468081487136
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862pmdHPCvZUjMWpXgda/gd026Xgdvgd+v:5peKvZqMSX+4+56X+v+Q
                                                                          MD5:A81864B2C0BD7BF81F4FA21F17800059
                                                                          SHA1:518AC9E040A17083ED3962F4FBB47D1D83764FF7
                                                                          SHA-256:AC004FD4B3C536406991EC13EBB3E64E0EC0C7B264BC18C0700C8FA545868155
                                                                          SHA-512:3C24F4C2CC3072B3E820FCC1C68A747DCCBB9481FE743C1555783CC932DCBA44FE4851A732D24EABF62E845474D4E1278F120A04DB7549A18C7C49C31FB8D425
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Darwin) {.. {-9223372036854775808 31400 0 LMT}.. {-2364108200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Eucla

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):759
                                                                          Entropy (8bit):4.110997549215461
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862EmdHvOYCvV2mV22wF2nUV2CF2+V2pCwF21UF2biV2cHVKF25V2VF2cV2tFq:5Eemdvg2wQCKZ4j5c0LVmtH1iknohwQT
                                                                          MD5:1BC8DBD2E24606EFA49F933034FC0EEF
                                                                          SHA1:A511695A1B87A689C6BFF65257C11D3962FDDA3D
                                                                          SHA-256:79D0C770A304360DB33F3D1EF7B3935F1E4E8125893E0DCE683AC35A51302CFB
                                                                          SHA-512:A839D390D70F22FC833322029B732F3AE68FF48793B07005041BD12322DD6E5D5E5FF31787AA004A507A57F8FC245133891F266C4EF19D49F085E6B412E5B04C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Eucla) {.. {-9223372036854775808 30928 0 LMT}.. {-2337928528 31500 0 +0945}.. {-1672555500 35100 1 +0945}.. {-1665384300 31500 0 +0945}.. {-883637100 35100 1 +0945}.. {-876120300 31500 0 +0945}.. {-860395500 35100 1 +0945}.. {-844670700 31500 0 +0945}.. {-836473500 35100 0 +0945}.. {152039700 35100 1 +0945}.. {162926100 31500 0 +0945}.. {436295700 35100 1 +0945}.. {447182100 31500 0 +0945}.. {690311700 35100 1 +0945}.. {699383700 31500 0 +0945}.. {1165079700 35100 1 +0945}.. {1174756500 31500 0 +0945}.. {1193505300 35100 1 +0945}.. {1206810900 31500 0 +0945}.. {1224954900 35100 1 +0945}.. {1238260500 31500 0 +0945}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Hobart

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8734
                                                                          Entropy (8bit):3.8515786470328823
                                                                          Encrypted:false
                                                                          SSDEEP:96:aOqigkx6WsYyS39nQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:aOq05hnQiAmcOM6e0pj
                                                                          MD5:5E04BF8E1DEBFCC4130FDD1BBD67B2DF
                                                                          SHA1:796AADCE7BB2FAF5E6FC916C941A4E3DCAFACC9E
                                                                          SHA-256:D813F6A97BEFC22CA4F24C59EB755D269B9C68A449CC7CF0D2C61F911860EBE7
                                                                          SHA-512:3A69CF1D1F57D6BD39E5F4DAF76BBB06A749D42BEB29452A0A5BDAA68F5DACC0DF176EDDA7A083F5B5B84FC651926C09D46CAAD2F6C4F1595AB9CCA1A958D653
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Hobart) {.. {-9223372036854775808 35356 0 LMT}.. {-2345795356 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-1646640000 39600 1 AEDT}.. {-1635753600 36000 0 AEST}.. {-1615190400 39600 1 AEDT}.. {-1604304000 36000 0 AEST}.. {-1583920800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AES

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\LHI

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):199
                                                                          Entropy (8bit):4.912882643701746
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yIoGEoPHAIgjGg6N/2DCkx/2DCPGUv:MByMjeXV6t2a8v
                                                                          MD5:425DC7B1E31F4AA41DAD74E3C9AE3562
                                                                          SHA1:D92A3269F7BF5EC00F082C64CEF6E20C43017180
                                                                          SHA-256:4D84E4040FBC529C9E0366BB74D0CFADEEEEDA0DFCC6C2C9204DED6C6455CAC3
                                                                          SHA-512:F3031F16C0D00D9F8A38CD378F599EB3E63F4FF85F120DB38E3013E93F08E6F512D969F164BBC88CD625910FB3E086F3352E5B8FFC1373C3CC98F363FB3FD3F7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Lord_Howe)]} {.. LoadTimeZoneFile Australia/Lord_Howe..}..set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Lindeman

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):824
                                                                          Entropy (8bit):4.249672335529665
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862gtmdHVCvCi0xT0ryRIvUr0obbty/ywtUj3yv:5gteMvCi6Xlt8
                                                                          MD5:504A422280E0459A2126E7CB02F527E6
                                                                          SHA1:EF61B98EFB1E44EE59020E99A69EA67D6B8ACFC2
                                                                          SHA-256:01B278309353849CC2FDF62A30E2FF483833D5713CF5E329252738BE6F2C0A84
                                                                          SHA-512:BFDAAD56D817CD3AAB17DFD0A33EFDD422645BC542ABE269C0F8520E33796DF4F19EAB2E40BFC6C4AF93EF654239B8F2E285639B4662040D865B9C340A23CFAD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lindeman) {.. {-9223372036854775808 35756 0 LMT}.. {-2366790956 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}.. {709912800 36000 0 AEST}.. {719942400 39600 1 AEDT}.. {731433600 36000 0 AEST}.. {751996800 39600 1 AEDT}.. {762883200 36000 0 AEST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Lord_Howe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7764
                                                                          Entropy (8bit):3.5615258807990537
                                                                          Encrypted:false
                                                                          SSDEEP:96:pmz39IyKxb/JbcD9gKniAF23QbNS1fEGXALNbbT2JFJ/FaKaTQ9ZJhRVK:p+cpVKniAF2AbkFKL
                                                                          MD5:10F983F4683CDE13A1228AC0B04D8513
                                                                          SHA1:45378BA5949BE53D698108F50FECFF50C9E3D296
                                                                          SHA-256:76D1F1ED67B8F8D6903789C2FDDF79590A83677972D416F5F3C9687614EC6238
                                                                          SHA-512:D60D802EF215A33750E4F859657BA12A67084B1E9FCF1B4A7CEEE7B9D816BC2C6670775D93C88EC8380CDD7790AD574133D6F90F0828F848313C26583B2F196A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lord_Howe) {.. {-9223372036854775808 38180 0 LMT}.. {-2364114980 36000 0 AEST}.. {352216800 37800 0 +1030}.. {372785400 41400 1 +1030}.. {384273000 37800 0 +1030}.. {404839800 41400 1 +1030}.. {415722600 37800 0 +1030}.. {436289400 41400 1 +1030}.. {447172200 37800 0 +1030}.. {467739000 41400 1 +1030}.. {478621800 37800 0 +1030}.. {488984400 37800 0 +1030}.. {499188600 39600 1 +1030}.. {511282800 37800 0 +1030}.. {530033400 39600 1 +1030}.. {542732400 37800 0 +1030}.. {562087800 39600 1 +1030}.. {574786800 37800 0 +1030}.. {594142200 39600 1 +1030}.. {606236400 37800 0 +1030}.. {625591800 39600 1 +1030}.. {636476400 37800 0 +1030}.. {657041400 39600 1 +1030}.. {667926000 37800 0 +1030}.. {688491000 39600 1 +1030}.. {699375600 37800 0 +1030}.. {719940600 39600 1 +1030}.. {731430000 37800 0 +1030}.. {751995000 39600 1 +1030}.. {762

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Melbourne

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8341
                                                                          Entropy (8bit):3.8532171550973526
                                                                          Encrypted:false
                                                                          SSDEEP:96:Yyigkp2EUyn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:Yy3VnQiAmcOM6e0pj
                                                                          MD5:40D06B80A4A0DB415270EFD9698B97BF
                                                                          SHA1:1999F0E8C7EBAA11BD21D64D9E07FA911F13C64C
                                                                          SHA-256:F21B9EA51C0D41BAD0420FE0601E5A4B491FB895856F4BDDF6541D704469D92F
                                                                          SHA-512:E47D597CC85D177CF2804C44C216EB4C5B74472457F15F697704311A847BF8A051DCAFD26FA61DD689555F35640151E26F25D5DC5319EFEFEA62AD86657A4A95
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Melbourne) {.. {-9223372036854775808 34792 0 LMT}.. {-2364111592 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\NSW

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.893713405897538
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjREeQWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DC5eDCyB
                                                                          MD5:80B7CDD1EA5A5308CE84C038180005F2
                                                                          SHA1:B7CA15B58ADA8CA3EB74B7971073022D57D8EE70
                                                                          SHA-256:73D7C9E207E61ACF8DF7242BDCD84488189033E22A84873A953B65DE02FA1B0B
                                                                          SHA-512:F627F5FF335600AC9158D6A0D3694AB7E70180177449C17B5605BBF7B1B7F8FB447A9C207F4E1BCB627074DB47B8A66F5D78E03C6DB8FA17F8BDD6AABB331665
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/NSW) $TZData(:Australia/Sydney)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\North

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):192
                                                                          Entropy (8bit):4.830368875485429
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjbvvXHAIgoXjbBvRL/2QWCCjsrQWCCjbi:SlSWB9vsM3yIFHAIg2N/2DCZrDCl
                                                                          MD5:14CB7EA1C028F457345EBEB8ADDC9237
                                                                          SHA1:208BF676F56533BA271D1B98363A766DF17CF6F2
                                                                          SHA-256:A983C9CAD7E542CAED43B083E68CD2B782959A4B54015F374C29250D3ACF9B8D
                                                                          SHA-512:099F65E5FA705FD7257CF7B8E103905EE313C6D082844F69CCD3F318E3E7F4098B29F952FA0AA28655E1FE290A0FB2E809911088315889DE7CAAF0E04698C2FC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Darwin)]} {.. LoadTimeZoneFile Australia/Darwin..}..set TZData(:Australia/North) $TZData(:Australia/Darwin)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Perth

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):739
                                                                          Entropy (8bit):4.31793586514766
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB8623mdHCBdCvmlXz6zezzOz4iaLYvzkzi4zm5fVcBhg8mfev:53eCB0v4+e3Oz4iaLYbkzi4zxhfqw
                                                                          MD5:01B1A88867472AD60B8F5C0E1648E3ED
                                                                          SHA1:9975EA750458E8061DD8A83585675CB7E4910CA6
                                                                          SHA-256:FC1B54CA261074E47A8A486FEAC12DD04D46166D1D2B44163BD8791BEC32D275
                                                                          SHA-512:20BDFBCD1A5038C81552EBD955F3921DE3447A1F30E64935937768B2B98735AE53049601DCDD2D519646C78E6D03289EB465CFF4F2DADEA7D89A329504C6C475
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Perth) {.. {-9223372036854775808 27804 0 LMT}.. {-2337925404 28800 0 AWST}.. {-1672552800 32400 1 AWDT}.. {-1665381600 28800 0 AWST}.. {-883634400 32400 1 AWDT}.. {-876117600 28800 0 AWST}.. {-860392800 32400 1 AWDT}.. {-844668000 28800 0 AWST}.. {-836470800 32400 0 AWST}.. {152042400 32400 1 AWDT}.. {162928800 28800 0 AWST}.. {436298400 32400 1 AWDT}.. {447184800 28800 0 AWST}.. {690314400 32400 1 AWDT}.. {699386400 28800 0 AWST}.. {1165082400 32400 1 AWDT}.. {1174759200 28800 0 AWST}.. {1193508000 32400 1 AWDT}.. {1206813600 28800 0 AWST}.. {1224957600 32400 1 AWDT}.. {1238263200 28800 0 AWST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Queensland

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):203
                                                                          Entropy (8bit):4.803539644461131
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yIaWhSHAIgPWAvN/2DCoRWJvFBx+DC7WN:MByMjL9t2rOvFel
                                                                          MD5:401B6B2E30EF17BE20212645287EB94B
                                                                          SHA1:67D15A45C61122CE680B829FE0FA3A1C501A8C8F
                                                                          SHA-256:DDA669B9BFB3E08FC23CE67030148B9E4740824ADD8DE02580D6AFD31CE05BAB
                                                                          SHA-512:F4348F8F4FF261C47854725AEE4E14E7E334B3C31496E5C46B0E0041551CB6861380E684E8888AFE9DA7E8E97236AC322B9CE2738EF245E9D46C9681665F83A1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Brisbane)]} {.. LoadTimeZoneFile Australia/Brisbane..}..set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\South

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):198
                                                                          Entropy (8bit):4.752918480727309
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yIDRpGSHAIgSRrN/2DCa7QDCuRpyn:MByMjdpQYrt23QHpy
                                                                          MD5:D226A0718185854DFE549E00856AA8D5
                                                                          SHA1:94EE96FAE259D90C2FDF169DD95BD82B3171FFAE
                                                                          SHA-256:D9DCFDC377901EC0C0FEB9CEA743C2C1425273F69A1BAA7BF3B74FEC5885B267
                                                                          SHA-512:7EE29A7235CAAEF4889246B7A2241CA9A0D5D2B2E1D56B20141247C93B8736F17280F0D46004AC4588E137D1E76F661C779C906BBFC2B5F8FA73C19F7657F952
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Adelaide)]} {.. LoadTimeZoneFile Australia/Adelaide..}..set TZData(:Australia/South) $TZData(:Australia/Adelaide)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Sydney

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8338
                                                                          Entropy (8bit):3.847525715050911
                                                                          Encrypted:false
                                                                          SSDEEP:96:AZJigk42/yn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:AZJuVnQiAmcOM6e0pj
                                                                          MD5:C0F1776E011C4C86B7709A592E7CA1EB
                                                                          SHA1:1CA528D529BF4995E145D6E0D87A8752A3577E7F
                                                                          SHA-256:FC453486325ADE1D31F14087B76D4936F3A6D551ABD1DB6FCAC129BDB043951C
                                                                          SHA-512:F872182962C2615A35F012ECAB30C88F07C6BEF0261207AD52706DB22D8CDD0DA65723CD801FDA7C548C5EB0ECFC39DD66CC17503BAA3BBB77BFA35D20650E4F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Sydney) {.. {-9223372036854775808 36292 0 LMT}.. {-2364113092 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Tasmania

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):195
                                                                          Entropy (8bit):4.777331394201868
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DC3neDCVDy:MByMjUQVv8At2+eKy
                                                                          MD5:9C58D9EFBB03472BBDA76CE2FFAD4BB4
                                                                          SHA1:30959E3681B64AE26F7FA3957887896C26AF7F19
                                                                          SHA-256:C94FA7A7640CD00963EE8FF1A3D9DCDA2075408739D998EDBF7CFC998DB764FD
                                                                          SHA-512:2D6B778217726691F2CB4A4995A8B1AB08DDB7FE4570A3FD04EF54F718F455EF3CBD4EEF1A1BCC99A2088C82A6E89DB455BAF1327CECD6BF608837E50F14A6C1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Victoria

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):4.818875198673406
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yIvFfkSHAIgoFNNvN/2DCzyQDCMF4:MByMj9fKaNNvt2xQz4
                                                                          MD5:0B144A2E47C81354BC510BC741DE5150
                                                                          SHA1:A7396F1741F02C6C208FD1286362E4E0720198B8
                                                                          SHA-256:DBEF9C5BDD290FEC5FA740D697143332D3CA1FC373CF1DF736F1883AC9BA3298
                                                                          SHA-512:562B029591F9ADB8C324BA56E849B2B524E91B26D3DB441510194882A8E1E63E6948D041874A00A0A76F29925A1CEAC53DD2AE5D7F23123B6FE919346CBFD8CC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Melbourne)]} {.. LoadTimeZoneFile Australia/Melbourne..}..set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\West

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.831654343064909
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjXFeyXHAIgoXjrWARL/2QWCCjH0QWCCjQ:SlSWB9vsM3yInHAIgOWAN/2DC00DCt
                                                                          MD5:5F5916CB038876BE27AA5E2AD74EE085
                                                                          SHA1:18AC21B638188B542455BA3DA91F958DF1724E68
                                                                          SHA-256:75ABB7F20C4A0B618138AA190AF33CEAF2A6D2C707DA6C1314E4BFF2F9904F58
                                                                          SHA-512:ADFD83E292AC1BB5E19255A9B2DA0E3BB9323A5F9B92D458DE34C291D7F9B6CFBBF62AA3351FB320E54F34305DD485ADC72134D21AFA6A27B2B8B7D93DCA2113
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Perth)]} {.. LoadTimeZoneFile Australia/Perth..}..set TZData(:Australia/West) $TZData(:Australia/Perth)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Australia\Yancowinna

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):212
                                                                          Entropy (8bit):4.918079927018121
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yIcKlHAIgJK3N/2DCkuM0DC9KM:MByMjcKeJK3t2kVSKM
                                                                          MD5:BEDEA56FCE4B2F0A3F3E9319856A5560
                                                                          SHA1:9FD0FE998A003C6B4CCCD00A977153347DE07F55
                                                                          SHA-256:55A9264D0414644A1BE342106AE86086A6659596DC9322A74FC4D1DDB41F7C60
                                                                          SHA-512:7C438B72262B99EDEEB31AC95E0135BB722A3B0B049278B6DE67DB5FB501837FB9C03785233B538E83F4B56104F6EA3B3DA0F7C2275E0F78F232161840AA4C63
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Broken_Hill)]} {.. LoadTimeZoneFile Australia/Broken_Hill..}..set TZData(:Australia/Yancowinna) $TZData(:Australia/Broken_Hill)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Brazil\Acre

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):194
                                                                          Entropy (8bit):4.888429541699473
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7thteSHAIgpth9RN/xWh490th4:MByMYdIp7tQ490I
                                                                          MD5:A8A7A10DA4321819ED71F891480770F8
                                                                          SHA1:930674EF7711542D7F471A59C1870D4576E027FD
                                                                          SHA-256:2F594239A434052D36053A2B3EAB134EADBAD06EB6737E67CF72166DAB157537
                                                                          SHA-512:C6AD1869A713DDE0E4DE53F7894E5CE0B7AEFDDD7C5C3D83BB5B92FB7D8E20B373A6694045053E1AE8EA98A7B7D0C052EF2C21310E47DC650A7A399A5F73D586
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Brazil\DeNoronha

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.875339623736144
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wKy4oeyXHAIg20wKARL/1bIAJl0IAcGEwKyovn:SlSWB9vsM3y7/rDSHAIgp/AN/xIAE90j
                                                                          MD5:E0D0EFBEC37E27532B49FF6DD9893DA0
                                                                          SHA1:9C00993A885AF448E48201A46E17629A7A602FC6
                                                                          SHA-256:A676562A90FF8587A775F6F0E3BE05D870456A56D25B5330816BF9043C8D475B
                                                                          SHA-512:AB0E6907F9C0002CA5C050A0069AF013B14BADA08CA4553C96B302C078DF7629D5D7EDE4A19A53DEC6E7B9E6D9857F14EC7A1DB9BC11F2EEC9FFBAC70E129EEE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Noronha)]} {.. LoadTimeZoneFile America/Noronha..}..set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Brazil\East

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):191
                                                                          Entropy (8bit):4.948480276987682
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0tQJXveyXHAIg20tQJE6RL/1bJHIAcGEtQJXy:SlSWB9vsM3y7tIGSHAIgpt36N/xR90tF
                                                                          MD5:FCCB5F44903E1B988A058E5BBF5E163B
                                                                          SHA1:E1CC03DD4A804C7305D8B0C12D8451D08AE262EA
                                                                          SHA-256:961FB3AB99A63B1E9704B737EAB2D588B5A39D253A213E175CC678BEDFFD498D
                                                                          SHA-512:F31C80E4AD6EBE6CB8A3382E0052DC47601D073E8F81375D50241105675AA3AB45433FFD0534524D9992ABE1086C6671D85FF7C72B0D6766EB9984426F608B77
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Sao_Paulo)]} {.. LoadTimeZoneFile America/Sao_Paulo..}..set TZData(:Brazil/East) $TZData(:America/Sao_Paulo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Brazil\West

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.902113962502196
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0znQZF3vXHAIg20znQv5RL/1bbAWVIAcGEznQe:SlSWB9vsM3y7zn+PHAIgpznSN/xn90zN
                                                                          MD5:9F4B43F4F27D0B7EAC0C5401A1A794B4
                                                                          SHA1:2A8543B994E93E54BD50EAA78463905E6A8EBE74
                                                                          SHA-256:0500C9A248C8CE9030EA30D0AF9DD95DC465480BAF60646C0B7C511FA23C6D1F
                                                                          SHA-512:0ADAF708ACFBD80F4704951EEBC24AD144FD5856997A429279E804F3A7F7F9A8FED41DCEE85BFB1ECDBF1E05137E87E7430186474BCF5DE42067FFC74746F048
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Manaus)]} {.. LoadTimeZoneFile America/Manaus..}..set TZData(:Brazil/West) $TZData(:America/Manaus)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\CET

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7736
                                                                          Entropy (8bit):3.7984816540097843
                                                                          Encrypted:false
                                                                          SSDEEP:96:09+xKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt7:9Ss41sFpM5vwA6Efv03TBZLl
                                                                          MD5:6DB983AD72FB2A88FC557BE5E873336F
                                                                          SHA1:C64E988010087ED559A990B3D95078949C9B4D72
                                                                          SHA-256:E2AEA7CFD428A43D9DB938BCC476623ADC1250BD8057013A7FFF5F89D7FF8EFC
                                                                          SHA-512:C0A646F80FB2FD42D9146A4FD36CF5A7F62016684F8D5AF80453EC190F4AEA65EDADC5BCF071AE746ABFB43B29C27B2743F2152B6986D41BFDE1617CA774A7C5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:CET) {.. {-9223372036854775808 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766623600 3600 0 CET}.. {228877200 7200 1 CEST}.. {243997200 3600 0 CET}.. {260326800 7200 1 CEST}.. {276051600 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\CST6CDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8505
                                                                          Entropy (8bit):3.8095769056779916
                                                                          Encrypted:false
                                                                          SSDEEP:96:e3HgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:eQaUqtfA604qSBgI7DBch
                                                                          MD5:A6F88C55E8613A27DE3E6C25B0672910
                                                                          SHA1:3B593CC17BF153A6209FC5AACE7B88DA9603BD44
                                                                          SHA-256:73A9841F233AA657AFB6CED8A86A37D55FE5582DD996B9B28975D218BCCC078F
                                                                          SHA-512:526A922B1594A2800B03F363F7BFEC29203D4A4F2B49C5F2618469F59176CE4F8AFBA0616B226AC39D308DB05DE7147714D9B6CDBB2EA7373A041A4D47F50E2E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:CST6CDT) {.. {-9223372036854775808 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-84384000 -18000 1 CDT}.. {-68662800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\Atlantic

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.804821796604604
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/0nalGe2IAcGE2NEOyn:SlSWB9vsM3y7UEOXHAIgpUEqA6N/0af9
                                                                          MD5:33A04963E70EBF29339204348E0DF874
                                                                          SHA1:456C0DB88ECE4D180EEE5AE5AEF5FBEB6E977D00
                                                                          SHA-256:6DC6354D761CBE7820C9186568CAB87AD48CA925507F6A740357195B60E16D87
                                                                          SHA-512:DF8F46827760BD7EC922C6837E0B6649B4FBD220B79E6F1B67FE3DD8CB3D2D035ECDAF4CF6CE5BDE6DC79C6F7B6EE2B9787AF08A97845CD0D647720A2E78D7EF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:Canada/Atlantic) $TZData(:America/Halifax)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\Central

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):191
                                                                          Entropy (8bit):4.863241040396457
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0po/vXHAIg20puFvHRL/0nPQox/h4IAcGEpoyn:SlSWB9vsM3y7pYHAIgppuRN/0d490pl
                                                                          MD5:97E50CE9FBA3F1A6DFCF333F9E6D592C
                                                                          SHA1:EE472C411079E788DBF32FAC9C5B7EE121960DC2
                                                                          SHA-256:DB32E83949D62478D229E9FB57BB1624D21B3A9CCEE4CD55335F8262C01D820A
                                                                          SHA-512:D547E3DC03848A677BE67F7CF4124E067F76EE09BB724A5B10F028BEA72C1526B17678A035B2C53F69498E9ECAACD3C5445D42B7FE58DF706DD2C5F2ADA05A73
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Winnipeg)]} {.. LoadTimeZoneFile America/Winnipeg..}..set TZData(:Canada/Central) $TZData(:America/Winnipeg)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\East-Saskatchewan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):195
                                                                          Entropy (8bit):4.90775999333305
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7hzi2HAIgphznN/0L5d490hzyv:MByMYhiXphntyQ90hyv
                                                                          MD5:E4114CC94C5C1DDF98535BF2B25BF109
                                                                          SHA1:212BE0FEF7039C0CDB8AF509927F4C03D8F72D22
                                                                          SHA-256:27CCEB515F9B2AB2D441F7C1533064AD13C89A6A009C3F2F14842B217075E231
                                                                          SHA-512:06C946DC79190F1C0FAF7F1F41BBEE4EE2A40910913896DE5AA94BC848DAB60F4F40A999CA4218FE1AA499854CCDD9379C937A9DEF273B2C7A352D8CAB8A5FE2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/East-Saskatchewan) $TZData(:America/Regina)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\Eastern

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.758562813220951
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/0nbHboxp4IAcGEqM:SlSWB9vsM3y7RQtHAIgpRQPN/0Dboxpp
                                                                          MD5:4365BEFA3D50EEE20843EF97A095E512
                                                                          SHA1:7756049B4CD6459742686925E9516E64A9727306
                                                                          SHA-256:22844994AE893F3236A091B050E932E84A5218EC0D01F72595E17CCC471FA564
                                                                          SHA-512:CB265E79DF926026BEBF7158590369ABE5353C759540F509ABBA2A7ADBE59A705BC2AB936F400614BE610EDB761DE9A2B1E179A0A8B0A87E595392362C2516AA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:Canada/Eastern) $TZData(:America/Toronto)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\Mountain

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):192
                                                                          Entropy (8bit):4.8181126338833655
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx07nKL50vXHAIg207nKLyRRL/0nNYLo/4IAcGE7nK1:SlSWB9vsM3y77G2HAIgp7bN/0W8/4908
                                                                          MD5:FA0D0024AD72CCE4EC7229FA897FB1B7
                                                                          SHA1:4373A07F2674FE974189CC801987652AA97F0204
                                                                          SHA-256:D7A203E60FF19DCDEAAD14121720DE51DA73392D25B40FFA301C1935CDF89517
                                                                          SHA-512:82EF7F429604A69734B04D298B4C9C9AC3BE57B9DD8C4CECF59C7AB3470BDFBA0505886C4E6AA3864F5EC7FBB4C69C54CF153A6417376828234833013C29A0C1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Edmonton)]} {.. LoadTimeZoneFile America/Edmonton..}..set TZData(:Canada/Mountain) $TZData(:America/Edmonton)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\Newfoundland

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):196
                                                                          Entropy (8bit):4.998628928230972
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7tgYJHAIgptVN/0xdBx+90twv:MByMYnKpTt590g
                                                                          MD5:A2DCCB8BFC65DD4E7C3BB7F10DCEFF11
                                                                          SHA1:6FD2F4FAE06C5D4D3F189A167A98AA76497569DD
                                                                          SHA-256:87F42F45FD7D059CA47650D445420DE8320F3A7C1CBC7671FBFA8A8881274433
                                                                          SHA-512:F42E32C5BD785BA914E5054784BF67DDF951460A708290D1899621CEEDC63475B584FC052A86A3B6D45BF3C651D42427FB6F9CE2A2A33764DFFF731053BECC16
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/St_Johns)]} {.. LoadTimeZoneFile America/St_Johns..}..set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\Pacific

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):194
                                                                          Entropy (8bit):4.887587766811186
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7ZLgXPHAIgpZLgFN/0N290ZLgK:MByMY13p1stx901/
                                                                          MD5:68900CE38FE0E40578323BBD3D75184E
                                                                          SHA1:9D5EAB5CBCD495DD46974207FBE354A81DD2070F
                                                                          SHA-256:5C4FD46054B190A6D4B92585B4DAE4E3A8233EE2996D14472835DDD264911DC6
                                                                          SHA-512:3EF53F0FCD8D88A1B977886BDFAA03D7B84EF021AC6BEDF7C571BFBF2242BFC3F3EB6A6B6A9C2F6852AF412A96DFBC30F3BB25A6619CBCD8736F3DF5B64DE1BF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Vancouver)]} {.. LoadTimeZoneFile America/Vancouver..}..set TZData(:Canada/Pacific) $TZData(:America/Vancouver)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\Saskatchewan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.887593462838566
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/0nogS64IAcGEsAzEB:SlSWB9vsM3y7hzi2HAIgphznN/0Hd499
                                                                          MD5:A4237BDCAF68B0EFECA97178F3DEE724
                                                                          SHA1:A9CBC02B5545A63A0C9B38C8FA7FA2DE6D483188
                                                                          SHA-256:46BA00AE3A07A4DC83D6CB517D87C9CBBA491B3421FE9AD6C74CAC5695EB73F7
                                                                          SHA-512:832BF256BE8CB2DD205DDE50017448D5830B46FF4DCA77BDB852067EE0C9DF9977014F2A3E3DD6944336158D8EA377CFBBE519EE5B56FB26EB64325B45476B9D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/Saskatchewan) $TZData(:America/Regina)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Canada\Yukon

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):195
                                                                          Entropy (8bit):4.889486451014262
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7peR2fkSHAIgppeR2rN/0CF/490peR24:MByMYkGk7pkOtBQ90kB
                                                                          MD5:490D99BD5465CBF5A8FE28F33180B8A6
                                                                          SHA1:4783295C31A804BE98145270ED28956A0783E655
                                                                          SHA-256:A1B1AF37DC89C6BA663E4E967A18409AE4E0FA9EF1B908D0461368DA31001C09
                                                                          SHA-512:9F6B4F204A21B69E1DFCB766C0671D3736414C73269DCEDCDB4FC3DBA869BBA1511DF6B5061F8964F0AF9C3816133D04E5DFB8A6AD07CA06E7712787A8FECC5A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Whitehorse)]} {.. LoadTimeZoneFile America/Whitehorse..}..set TZData(:Canada/Yukon) $TZData(:America/Whitehorse)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Chile\Continental

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):194
                                                                          Entropy (8bit):4.812019117774239
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7tfEJkHAIgptfEJo5N/0rHM490tfEJB:MByMYE9pEOt4X90EB
                                                                          MD5:6EF54792279C249B16877100682F1806
                                                                          SHA1:A62629EA055207D917740E3AEF4F0B005EA49CC4
                                                                          SHA-256:5B40167DD0C0B5C293861070C4AC249F78DDF8BAD798DD0165E3AE894C9B9570
                                                                          SHA-512:3CF93003C3EA2B4386660F0C87074F9AE2BAC4EE72D88451DCB1EA8B79502D2187B1608B6D5CE8D7EDC00AED99CF9DB7B006EB6ED2A2B5009F2C0E757D282D74
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Santiago)]} {.. LoadTimeZoneFile America/Santiago..}..set TZData(:Chile/Continental) $TZData(:America/Santiago)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Chile\EasterIsland

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.808907056781067
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG7ZAJWXHAIgObT7ZAiFvRL/0bxOdBx/nUDH7ZAZv:SlSWB9vsM3ycJAUHAIgObJAiRN/04dBn
                                                                          MD5:2EC4FDD1EFBAF1D9F9DBAC8B1B5EDD09
                                                                          SHA1:FECED8EBC7B666628B7B45C9694FCB3A0B20A42A
                                                                          SHA-256:1E2DA1862E0E0F131B7C6EB12FAC5F920852C61C162993A30BC843A464A5AAD4
                                                                          SHA-512:74D61141505BAF1ABAD61FB91941C63C169EFE3C85829FEBB4D29A72EA54D1A07EC84E2E9B48E963E65CBF7663245459FAD288D620B1BEFFE682A2D1C243794D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Easter)]} {.. LoadTimeZoneFile Pacific/Easter..}..set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Cuba

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):175
                                                                          Entropy (8bit):4.857134440822812
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx02TEMVFfXHAIg202TEyRRL/0lIAcGE2TEMy:SlSWB9vsM3y76EkHAIgp6EyRN/0l9068
                                                                          MD5:3FB16EA4A9B0529220133C4A7B05215B
                                                                          SHA1:BD56B6E76A92A5925140CB5CC3D940E1DE90993F
                                                                          SHA-256:6F4F2D7F5BCA4E5183460C0153D2B98F5239A99F149DE6638B311C73CEDB1329
                                                                          SHA-512:690EC1BCE7FA979BD55725B8ED6DF042BB331CAD332827B2C64B31F107539934AA5A30268B1F03D52697528E68A1BA72E4D56B5199A68B1ED897B75FAFB33A8A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Havana)]} {.. LoadTimeZoneFile America/Havana..}..set TZData(:Cuba) $TZData(:America/Havana)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\EET

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7440
                                                                          Entropy (8bit):3.695300167191082
                                                                          Encrypted:false
                                                                          SSDEEP:96:CgDIMcVbf+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlt:KlfyDjivBeRF+W35Syrwl9h5j
                                                                          MD5:34339D40AC889DCB5A09D10F123175AD
                                                                          SHA1:57E1F70FA8999106FA3874A9CE1E75A7ACBC81E9
                                                                          SHA-256:64E284F9F7A36CC0A352809141D76E73A99344A9F30CFFEA254CBB9D2C589ADA
                                                                          SHA-512:2DCF16D9D7593FC3E5844E18FD689AADA157866490CFD37A38A47F747DDA189822055F6DD470CA2D77040D2C5A2527512880C22ED8EC16D9424EDF3DC228AFED
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EET) {.. {-9223372036854775808 7200 0 EET}.. {228877200 10800 1 EEST}.. {243997200 7200 0 EET}.. {260326800 10800 1 EEST}.. {276051600 7200 0 EET}.. {291776400 10800 1 EEST}.. {307501200 7200 0 EET}.. {323830800 10800 1 EEST}.. {338950800 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 E

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\EST

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):111
                                                                          Entropy (8bit):4.924838898127838
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yLbNMXGm2OHLVva0v:SlSWB9eg/ylDm2OHLVi0v
                                                                          MD5:B221E7141FFC9DEA317F64F81C7BB4E0
                                                                          SHA1:B13BBDE790B169D8B9075275523F319D5173E2C7
                                                                          SHA-256:6344BE02529C1CC5F7B5FE14B7E9BBCED4DDE68A24B824601EEBCAE207ABFDF2
                                                                          SHA-512:FFFA733476D6C7DCF49C0B88C9F5E381DE2B69BAEDF6C7B1D91C6F45CE2D36E06D40F25B6BB65D4B5D650471BB52CD2EC3F68703DAB4BD5414F8D3F831D92BD2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EST) {.. {-9223372036854775808 -18000 0 EST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\EST5EDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8505
                                                                          Entropy (8bit):3.8091719283634853
                                                                          Encrypted:false
                                                                          SSDEEP:96:R+kNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:RXoSItON0HY2iUmUFLqU
                                                                          MD5:4578FE48781599B55F4BCF5560019789
                                                                          SHA1:4EAA7134621DFDEBFD1405F5CC58227FA7E80C3A
                                                                          SHA-256:0BE6161403BC5A96BFAB174F2C3FCBA8A677D4349699B408E9872B9DD0FE15CE
                                                                          SHA-512:9ACC2EF396F635D22E3DF6B785831AD74B510049F1BE85F996467A5BBC0DF49A28B2FC3E4CA0CA9DC8FC2C29EA50D909F0B153265B107445D3052E81D9A4D50A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EST5EDT) {.. {-9223372036854775808 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-84387600 -14400 1 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Egypt

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):170
                                                                          Entropy (8bit):4.862365884559795
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsPHV5XHAIgNGE7TRRL/yCh0DcPHy:SlSWB9vsM3y7fHAIgNTRN/yg0DH
                                                                          MD5:ACD69F34396296BA553243267D06CEE0
                                                                          SHA1:9575FFE5E7833B9532F17AC5413EA9DB23F07ECA
                                                                          SHA-256:936B6484469351DEF8FAFE8EC180862729F5E43BDE4E53E2E9636E221B54C3C2
                                                                          SHA-512:149D23FF35747127E9A2F4056D09472E8E689970BC795D5411C5BF621D949ADDEBDA68674D375A248A63106ABDFF6C54A8AFE5385C45BE2916CAED0C30F7C4A1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Cairo)]} {.. LoadTimeZoneFile Africa/Cairo..}..set TZData(:Egypt) $TZData(:Africa/Cairo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Eire

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):172
                                                                          Entropy (8bit):4.901791318009318
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV5QH+o3vXHAIgoq6QHFRRL/yMQs/h8QanQHuv:SlSWB9vsM3ymnQeoPHAIgonQzN/yM/hm
                                                                          MD5:E9C2C97EB65526F1D4BE1AD7385336FA
                                                                          SHA1:09E4000CE320F779E2DFCA2FFD6B9258FFBA6CE4
                                                                          SHA-256:B78A833337EFEC8B5F64622F1BFDA21FCB79CF290E9CF32A54B206EB20C6FDE9
                                                                          SHA-512:EAEC097B58BF466CC7D6C0C6297628AF910CC308AC822565FD6CDABF96CD4EC57D4CC724FE782B6C1B606DFF9424013F6A890A871339577F7CB68BBB3C425E65
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Dublin)]} {.. LoadTimeZoneFile Europe/Dublin..}..set TZData(:Eire) $TZData(:Europe/Dublin)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):110
                                                                          Entropy (8bit):4.928744204623185
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDMbNMXGm2OHvDwy:SlSWB9eg/yRQJDm2OHsy
                                                                          MD5:9C08898081382F52CE681B592B8E2C8D
                                                                          SHA1:165944424740B1FA9B4B3B8E622198ABD0BDA0F8
                                                                          SHA-256:66B0DF8888883BFF44B18728B48CDF24AAED0BB745D601F3422C4F2D4063E0AC
                                                                          SHA-512:86EA639F999169F2FBA2457BE5042463A1938031268CCA71FDD03CCBC6194932937BA58B49FBED461E055E9AA668FF6EBF391AA7EC603C0A425416DF2E6CC84D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT) {.. {-9223372036854775808 0 0 GMT}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+0

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):159
                                                                          Entropy (8bit):4.910789466104329
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDOm7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRSw8RQy
                                                                          MD5:333F2BFA92742A49BB88F11C7CD896A9
                                                                          SHA1:BB5BEC010C36427AEEBDDA2FB72083E22A3F5073
                                                                          SHA-256:64466EA3759301E88C29AD1A833CDCBBC495EB4A5A3AC45E7B2987FECD6702BD
                                                                          SHA-512:E2270F4B57C5F1C849726259B886E8644DCF497FA0D034AD48885146BEDC70DC8899900DA9AC01F2609A2DA881E10F9042CCBF75A3F5DA7344D7E92F1B070806
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT+0) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+1

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.980500771169276
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOveyXMXGm2OH1VOwVn:SlSWB9eg/yRSvPDm2OH1VOwV
                                                                          MD5:A7C3FD06D1E06F125813C9687C42067C
                                                                          SHA1:515622C0B63E977AFBFC78AD8466053C4A4A71A6
                                                                          SHA-256:3BE1EC71D2CC88FA9A3DB7DC0476475F33FE5BCBE6BC35C0F083859766466C32
                                                                          SHA-512:548DA608CFCA5B8539652F94CA2040D624602D2DF64B2C8CCDB8B219B9B384E01386CDF95F3BF77409DF0584FA12A3B73D56D13107D98BEB4C2555F458B3F374
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+1) {.. {-9223372036854775808 -3600 0 -01}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+10

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):118
                                                                          Entropy (8bit):4.965033464829338
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOPFNMXGm2OH1VYU7vV:SlSWB9eg/yRSPXDm2OH1VYW9
                                                                          MD5:FF71149E56D4CB553D0ED949B5F4C122
                                                                          SHA1:3459B47E0EEC80D7A29512CA4F3F236C89E86573
                                                                          SHA-256:E61E826E6FBC2396EF152640698098F4477D4FFDFE5F791F62250C3EC5865304
                                                                          SHA-512:43B0CC8BD7F1EFC80C3F14F115D651EADD5743B17B854C2FB7AC25995138D3DF8792915C2952B80F35784A7115F8FB335ACE171479B24C668190AC175523DB21
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+10) {.. {-9223372036854775808 -36000 0 -10}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+11

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):118
                                                                          Entropy (8bit):5.002239901486653
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOeJMXGm2OHaBByVn:SlSWB9eg/yRSsDm2OHa7yV
                                                                          MD5:08AABA917A8D6B3BB3D0DD1637F5ABFC
                                                                          SHA1:D1D704F0250D4CBD450922A02D021E0000FBF5CF
                                                                          SHA-256:143528946275DDC8B894218D3F1BE56C950F740828CEC13166C3D7E8E1B6BB7E
                                                                          SHA-512:F37AE54864A613C830308CB94AB7CEA9534A86A53B52B4A2C28CEEFE6F5BC0518143AAFD77A6DA5EC55D392F5BD34FCD4B5BE51794B1A386ED783B9BA89C10C3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+11) {.. {-9223372036854775808 -39600 0 -11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+12

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):118
                                                                          Entropy (8bit):4.97889339723103
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDONdNMXGm2OH3FNyUFFv:SlSWB9eg/yRSNDm2OH3XyMv
                                                                          MD5:7374B66D6E883D7581E9561C3815EB92
                                                                          SHA1:235E96A7420DF6733F3CA368D4A2D57766656043
                                                                          SHA-256:A93EAFAC2C1089C608C8536127D0E8B53D8C7CFD13AE7DD69339E12A89F803C6
                                                                          SHA-512:9BA59B17F20D65DFF1A5A2D557B535F69B04C172AECB15F88CA3484D74CC7D53894985C08653CF13D868BCBD5E7E5041E0CB2F457B5B603F3851198E552E33A7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+12) {.. {-9223372036854775808 -43200 0 -12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+2

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.922268982357521
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOcF3vFNMXGm2OHnFQVIyV:SlSWB9eg/yRS0fXDm2OHnFQVb
                                                                          MD5:FDDC663E40F8FFFE27959E94625725DF
                                                                          SHA1:EE3FBC1F6C8BBCF1BDC9E5DB4D2EA1A57E2E9BB3
                                                                          SHA-256:AD5833153446960BDE0653A22AE2111BF80CFD61C3010993CE87B81D40C75C72
                                                                          SHA-512:A1B2A153834FEAD7DC27C0918E1B1CB905671F82850C1CAAEBD89F5535703FB259F02F699EA7F82F3044E37668EE93DFA4D4EB862CD437AFF0DABA84867B1963
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+2) {.. {-9223372036854775808 -7200 0 -02}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+3

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.949132511023475
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOFfMXGm2OHBFVGAvFv:SlSWB9eg/yRSlDm2OHBFAKV
                                                                          MD5:5C6F16F2CFD46030688066F9BFBE675D
                                                                          SHA1:1DB5F36584822EB92E75B9AC9F440FD671BD90AE
                                                                          SHA-256:C7BEE4C71905EDDB40BAF42C0CD0DC70BB9F298EAAB8B9367D484B8431DD084A
                                                                          SHA-512:FFB2C4CD8EA7DE165C3D989454898FF2023D1A1E3B2B34EC23B1B71EFA7BF2538488DA0069E59F1152B8933D2263B762D2D7C56ADBED826C33FC0BA6672E34DB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+3) {.. {-9223372036854775808 -10800 0 -03}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+4

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.971627677226461
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOqJMXGm2OHBvGQy:SlSWB9eg/yRSQDm2OHBON
                                                                          MD5:E35244C1A6084C7BC1D79E437677C55C
                                                                          SHA1:898619DA4B8B9AC72E69C7BD30DEA2ADEF9440FE
                                                                          SHA-256:26D1EF512CC5797FC63BA2B83C7D6271025F4D4F5C904D9FA8E97F053393D9A7
                                                                          SHA-512:0687758558C4C5FF7802F3A57212694A1515761A8337D4B75FFE81434D2AD8A221B005DEC36BF013F2FC3DE1E46DFBED36352811EB7C5A5AE3A167A2E314F57C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+4) {.. {-9223372036854775808 -14400 0 -04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+5

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.956438091983076
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOJNMXGm2OHLVvyV6Aov:SlSWB9eg/yRSDDm2OHLVKVg
                                                                          MD5:7C560A0F3C42E399AC1247CB6C516DC6
                                                                          SHA1:C314B09D4E369C69C23A8DC1FB066FD0CFDC7211
                                                                          SHA-256:054910BDDFC44D9B806BBD3008C30547FA57ECD3C043418C406A725158144688
                                                                          SHA-512:FCE8431B759BD5359847734FD98D9D91394916235B2AF587FC927D5F3196FB283E241A6A9200EA852F9265ECEF81402FF6ACD0FA3A4AAEF6DF9DB1B056B3A9EF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+5) {.. {-9223372036854775808 -18000 0 -05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+6

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.974743300958087
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOAkSMXGm2OHvTmULyn:SlSWB9eg/yRSbSDm2OHviX
                                                                          MD5:EEB1A3E0FD3339E332587D19C116D4EF
                                                                          SHA1:5DBF046031CD354B1EF88E46D3FED74706D21AC6
                                                                          SHA-256:D53BB247E0E429A6243AB9A9BDCAE1EE1CF5F271D79748A843631906AB63A988
                                                                          SHA-512:07BDF9056DC335C773684E634B1D389FBD139464D4597DE862B7EAC096676A093934682BF911F4E68F299789931218C0E431F0CC6BEBD7275B5FC8015EDD0942
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+6) {.. {-9223372036854775808 -21600 0 -06}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+7

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.930134062078826
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDONeyFNMXGm2OHrXVYVny:SlSWB9eg/yRSNPDm2OHriVy
                                                                          MD5:F92B31548D6BF8CCFA326C0CA6E205A0
                                                                          SHA1:3FFC6C214EDBCBE9C2509306CE73B429113E1C8A
                                                                          SHA-256:6BA5779E35D581B409F53B14B6E28ECC16F536FFEDD45DDBC8DAE4B8C28F66E7
                                                                          SHA-512:317872E986099D02AF083397AE936854043D54CEBF45A70672F02DDC9E2F3B27BC3FA80902F9675131C51A09BBD3C2BD1CD437330935CEA113C643769E0DF20C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+7) {.. {-9223372036854775808 -25200 0 -07}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+8

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.915798027862021
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDOOF3vXMXGm2OHmFvGpn:SlSWB9eg/yRSqfXDm2OHaOp
                                                                          MD5:B31B15E6006F8DF0D7627D6C90FF39AF
                                                                          SHA1:7C4137BE11DA84771DF6DC5EBC32D5E5E87E060F
                                                                          SHA-256:CA87559B154B165E83482AEE3D753BA8E38ABCA347A005E8504C566433CF4CB3
                                                                          SHA-512:220F7E7379EABBC8ACD7ADBB7A4AC8E93E4B268F8F1C0965B7E6A09735EE86E293EF1C492990331EEB4176B8301A91EC20579756B962AE45C858A96C09349CCD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+8) {.. {-9223372036854775808 -28800 0 -08}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT+9

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.95764928386407
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDO3fMXGm2OHNms:SlSWB9eg/yRSPDm2OHNms
                                                                          MD5:5B10173EB7119F1219250763504A3526
                                                                          SHA1:A845021437C4638079040EF27AEF163C865FF8F8
                                                                          SHA-256:A0987A1D078B0993FB3B07208E3F4538A2319DCDDDEB2FAEA32FC463DEAFB8DB
                                                                          SHA-512:D213285D0A723B7771263122AFA269C2ABD0325A97D32C3870341255C06597DD6851C22860CFF42BF54E3FF5A36FC88C306F3BF1C69E7BD7FD7F69FE7601ED1A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+9) {.. {-9223372036854775808 -32400 0 -09}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-0

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):159
                                                                          Entropy (8bit):4.898210849752128
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDIyHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRUyJ8RQy
                                                                          MD5:5AFB7F12BA056619252D48904523DFA9
                                                                          SHA1:CD6E6681C8302BF38095975DF556BD14959FDAC8
                                                                          SHA-256:EFF27B3DEE9306641FF344801E06BB33FF768CDCCFE2409FA8AF752FF6D39F66
                                                                          SHA-512:2869BB347F42667A3D174816466B15916FC61FCB5A6A1BE1DD750C5C1751602FEE0FE5A27651B7A19C9F6764872DD0F00D3D5AA16CA1A743DBA09646D25A4EB2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT-0) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-1

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):115
                                                                          Entropy (8bit):4.979902281541545
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDI/fMXGm2OHMKUrn:SlSWB9eg/yRUXDm2OHtUr
                                                                          MD5:4000096844091488200125FC8F50E2F5
                                                                          SHA1:9FFEAE66405CFB254180C7DBE185288791DFEE5F
                                                                          SHA-256:B4BF883FBE9246EF4079179A746B1F9E59F2C77D4F598794B60732D198DC6044
                                                                          SHA-512:25C69E04018C2978A2E5748F0D3C61157453D998C16FA4B3C257A6515B87F5FD2B754893B47604BBC60AB60B60BA162BF2D1463E616E72CB8713C736F1B4D428
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-1) {.. {-9223372036854775808 3600 0 +01}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-10

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.964101313797091
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDINFeyFNMXGm2OHMUUMy:SlSWB9eg/yRUN5XDm2OHXFy
                                                                          MD5:AE6601FACF6BE1E68083F8D353901181
                                                                          SHA1:8B3BFA307D2A94BADD3A1A5E42545D6F7C620BCE
                                                                          SHA-256:EF3046D7789CAE069B5473D053F3EF0157248F8A359A1282EE02BA613A75FC94
                                                                          SHA-512:1859E6A2CB94EFEE7CD5C17803AA4F2DEEBE4DCF43D3B1EA737DF00BA86ECEC79D296D75E69D5829DECB48380B6B650724104FFA7959FD18FE032DF7D002A88B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-10) {.. {-9223372036854775808 36000 0 +10}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-11

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):5.00162575418652
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIVSMXGm2OHlVVtyn:SlSWB9eg/yRUVSDm2OHlVLy
                                                                          MD5:D864BA451C9E441BF47D233626C57B99
                                                                          SHA1:6C38E6F8BA292575C496124572D187F97C9F8E73
                                                                          SHA-256:CCDEADBD18BE81E59A669A460A14AFCBFF733C3A5D164FC2B6B93DEAF009B78A
                                                                          SHA-512:5C16BD1189F3FE6789CB3630C841FD168EC87D0498EE6FCC4C8D635F8CF4BCAF0558B44F859C37E418F6BC5A7F6693D6EF1DD218A1DB6DA2D54FF55916685119
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-11) {.. {-9223372036854775808 39600 0 +11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-12

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.978079707159482
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIjbNMXGm2OHwvv0UIoAov:SlSWB9eg/yRUjJDm2OHwvv0YAov
                                                                          MD5:C3E7748C7CB9D8A7F7FA5170D5098983
                                                                          SHA1:54F5374A32173BEC6EDA430745DCD18749ABC233
                                                                          SHA-256:23B61B18C653E25F7245B0BB6E04AD347E038585B145962FD1EEACE26F118D54
                                                                          SHA-512:4783A7CD4C94CCC67C1C71F9C5D9CD99A3918EA4792D8CE2443ACE8F034B9023EBC02405B5DEAB919AA35FD1FD29D8980774316AC96D32ECDEBEFA15BBE6878D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-12) {.. {-9223372036854775808 43200 0 +12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-13

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.994320173226919
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIaMXGm2OH1dNv7Dy:SlSWB9eg/yRUaDm2OHty
                                                                          MD5:224AAAA8A31C283F50149A090E3970D5
                                                                          SHA1:E7E4876EC2474FEFD82D4B174CA8E3A3427062F5
                                                                          SHA-256:A9F1AD5A7CB5ED43C5E6E8A7A9B887329890ABB75B9FC9483B8543A367457EBE
                                                                          SHA-512:6EE0C6F519AAB2DAA3F7D802F0F838BA9F6BF1D56530000D3C9EA4FDA81DCB9832A3285E36208F29EEB23C27EC5BFD3438DC272929A7531268B7C0626A65D6A5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-13) {.. {-9223372036854775808 46800 0 +13}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-14

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):117
                                                                          Entropy (8bit):4.9895752453470585
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIxhfMXGm2OH0FVtXvFv:SlSWB9eg/yRUxJDm2OH8jNv
                                                                          MD5:8ADF71739DCADE63433B7BF8321EAC77
                                                                          SHA1:AA6BDE83FF0D8BCFDE0426160250F2D17D3AF81D
                                                                          SHA-256:A37A7160027BD38356764C4D1AA5B9B17F8D5DC3CFB81EF2ED399E44C41734CE
                                                                          SHA-512:AEE3929DE269ADB5265A54841F041E41595359C101539F6309A4E737E3F5DF0BC91560781C7118975398C29A084113682C78F66E07E2E4AC5EAC8DFC33C4F0ED
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-14) {.. {-9223372036854775808 50400 0 +14}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-2

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):115
                                                                          Entropy (8bit):4.921164129348819
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDInWNMXGm2OH/VXF9:SlSWB9eg/yRUnSDm2OH/Vb
                                                                          MD5:CABB864F4E76B90928F5C54CD9334DEB
                                                                          SHA1:4818D47F83F16B9F7612D1E979B2440C170ECDB9
                                                                          SHA-256:7211BF8329B2388563ED8FA8C5140099A171B8A303A9473E9A6F3AF0C5D239CB
                                                                          SHA-512:1FDCB05D675F1D28CB52B9F5EAC7EC52FDF2CE7E7411740A6F8FB5E9D443ED636CE268E3AF9E08605CC3E13A49B2D86FF4EA6A85F518D5C79E263BA94263361D
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-2) {.. {-9223372036854775808 7200 0 +02}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-3

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.948161547682094
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIYyXMXGm2OHkNsWYcv:SlSWB9eg/yRUlDm2OHkKWYe
                                                                          MD5:4AE5F29A13A86E4A7064E9200668E43B
                                                                          SHA1:2460BD1BB0FF3A3C774A5C7CC3DA10235DA06B0D
                                                                          SHA-256:BFC86D65B0B94725DCE4C88EDC4300141ABBCA4B6CDECF037C437DF49F0C1D6A
                                                                          SHA-512:190DC38B4A20F964C967866507086317D85D979DFCFA415D1569C485C6476024922BC6E7103273C41889D9D7B22E97933F286FCF4D341248077C1BA777D0EE3B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-3) {.. {-9223372036854775808 10800 0 +03}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-4

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.970850637731657
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIQXMXGm2OHkVsRYovV:SlSWB9eg/yRUQXDm2OHkSN
                                                                          MD5:BBAF760E27C02D176A675AC3CF2D1E6D
                                                                          SHA1:E524FAA7D424A1C1545D1D8EC00169125A68E8E5
                                                                          SHA-256:02E2EEAF88EE179EF63DD29ACC7384A4B46DE1E3A151C1F3A5DD31BBB5A05AEE
                                                                          SHA-512:6AC7CC0E52E7793C7F2D3DDA9551709DEAE654C1182EAD7108D04F1BAAAB7E1C473B6E8A3A126B0E421D8A246294A03B2EE9E070330924502DF2869CC61C37F7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-4) {.. {-9223372036854775808 14400 0 +04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-5

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.955530107787899
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDI7tNMXGm2OHM0VQVFv:SlSWB9eg/yRU7PDm2OHnVQVV
                                                                          MD5:17F64A5969D3755211E60C0A9F83974F
                                                                          SHA1:FEFA84725EFAE6405F43797296C342B974F2D272
                                                                          SHA-256:3A2C75DCA11D1167126F0D44A8682420FAF75B0B82B3DCFC35A9F028A9A759E8
                                                                          SHA-512:77DBCD8284A470E4869976E2E8A5EDE28104283F120C863785A6B2E64CF87E06243196817C0055A9B32D6FFFE94A25772F67D58BF8E885F7EC06C34FABE38766
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-5) {.. {-9223372036854775808 18000 0 +05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-6

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.973993120288556
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIg3fMXGm2OHETNSTVVn:SlSWB9eg/yRUgPDm2OHETMX
                                                                          MD5:51CAF7956E133C8A9788AE0B8C6145AB
                                                                          SHA1:47F8B49DF9ED477BD95F908693A483AE4FDE881F
                                                                          SHA-256:D22C87321373EC0EFB0F312925476CD0747323EF303E17621A871BF814C8ABB1
                                                                          SHA-512:EC4B4BE74C1BA64DEC8EF11DAAA338C52BD67D55E8A2352FBC6C83FA142F8DBE424CC1110E9A9D9A891E1E858D1FFA6D1E3B997D41BBB374556FA1F9A708559E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-6) {.. {-9223372036854775808 21600 0 +06}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-7

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.928999319005163
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIpdNMXGm2OHAXUVSYovV:SlSWB9eg/yRURDm2OHAXUVSYyV
                                                                          MD5:56D88B54CA33B43E2E7D3EA6AD3A4D6E
                                                                          SHA1:9351E0C001C5D83325281AF54363D76D65548B7D
                                                                          SHA-256:70CB3A766A2E84148B68613D68687D263D3592ED4B6E672797FB20801ECA8231
                                                                          SHA-512:32B58AD16F64590903C7AB49BA4890DAF6F1F3D33187A7654D3DA88A1C0047483EAA58B2498D824A30116E235FCC8F8FB3FADD57F86396240E5D92B2CA337027
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-7) {.. {-9223372036854775808 25200 0 +07}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-8

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.9145396982864895
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIlSMXGm2OHN/VsdYLyn:SlSWB9eg/yRUlSDm2OHUp
                                                                          MD5:E462AD5E0C046EA6769EDB4B2C80F4D4
                                                                          SHA1:6DDB94485648622875E0927BA1E8CFE67CEC1382
                                                                          SHA-256:80C85D59416CEC91DB3DAC5FDD2FD7B91D6FC74A37BBBEF6FF58F6F6816E8FC9
                                                                          SHA-512:42734FD2DA8BD6E0BC271FF1375A31DEB72EED85AB5EA6E1E0F81EE4E3E7E74380FFC98FAC30409684F736DB580AAAF4F62DB4757AA35C10383584F6144EF363
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-8) {.. {-9223372036854775808 28800 0 +08}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT-9

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):116
                                                                          Entropy (8bit):4.956751740978211
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRDIeyXMXGm2OHENScFAy:SlSWB9eg/yRUPDm2OHsScr
                                                                          MD5:98F70EC1B1AC7D38CB8D01705FB0CA56
                                                                          SHA1:EDAFA132E48935ACEB8E72D3FF463E4FC857C1A9
                                                                          SHA-256:57395BB968AFA5A041EADA4B684B82F0379A9333F9522D69F069A79FDEA2B8D7
                                                                          SHA-512:97B8D7603D6B54C075B005B905B2A7A28B8BEA67894F055663C44D2BF730BB937AC8EF5B2DF182BDD2D9EFFDBD135DF9467C813AEE39AA6B34256908A12DC011
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-9) {.. {-9223372036854775808 32400 0 +09}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\GMT0

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):158
                                                                          Entropy (8bit):4.886484135647838
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDVMFHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRC1p8RQy
                                                                          MD5:F879FB24EA976394B8F4FAF1A9BF268C
                                                                          SHA1:903714237EBD395A27EAF00B3DAAA89131267EE5
                                                                          SHA-256:AB742F93BE44BD68AB8FE84505FA28120F1808765D9BAED32A3490AF7C83D35B
                                                                          SHA-512:F5EE4C331E37036516F2A1BF12F2E088B2E2C7F6475127BF4E7B4937F864550D64D570BC855B6058D4311755E8696EC42095A36AEF13BB29E62192EE0AFB6EAF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT0) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\Greenwich

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):163
                                                                          Entropy (8bit):4.911342539638601
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRp+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRp6BURQy
                                                                          MD5:CDD2DE9CF0FECFEA0CDD32DAC32DCDE2
                                                                          SHA1:311CD4C6E819E18BAAACC382F81359BC208E2F73
                                                                          SHA-256:F89167B6117838D9679C0397496B6D96D3A7BEAEF0BD99406ABACDBDB658FBCC
                                                                          SHA-512:1AF061D07D2F579A089905B6B259AABD7C58F4FA0CD379EE54206164F0DCAEA5C720FB1F5E76F5782F8613E62D8F83BD55F1848D5D7A73D4A5C9F7BC6B9F5DB1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/Greenwich) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\UCT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):157
                                                                          Entropy (8bit):4.838936002050477
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRKh8RFB:SlSWB9vsM3yzTHAIgm6N/yR68RX
                                                                          MD5:0587EB7D1B1C684A4A0F90D3CB0959C8
                                                                          SHA1:3F2840AE512774494D9A0B6357C52CCB7DBA5265
                                                                          SHA-256:0856D14DBBC53D46460BCD530BD070E9E8966D1C96BA01BA556E215A98C09CD4
                                                                          SHA-512:DE38EF28893853219AC24AE4A522307ADAA1502F6D0C129219FAD9D75CFCE03A505C3E0758CFF2D2D4F7101414A5F7E4FC1C1B119B667E6A9C89B60DDA641E86
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/UCT) $TZData(:Etc/UTC)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\UTC

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):110
                                                                          Entropy (8bit):4.903699772785336
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/yRF3yFNMXGm2OHvL:SlSWB9eg/yR9SDm2OHj
                                                                          MD5:3D3F94B6AC5FA232E509356C703D9177
                                                                          SHA1:502B8EE9D4A1EA75A91272181AC87B9B6ECE1F84
                                                                          SHA-256:4D74D9EC2397B1708FEF47806294B0BCA26679F3A63149AE24E4E0C641976970
                                                                          SHA-512:205A761A01C577F602236CB5C9938C834B7F3F9F681B94036B0A86101119893EF87D206D0C3F7737075ED833D4E35E374ACAE6605163E9C37B705D99BEBC928C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/UTC) {.. {-9223372036854775808 0 0 UTC}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\Universal

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):163
                                                                          Entropy (8bit):4.874807282103623
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRYzXDJMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/yRY7VMr8RX
                                                                          MD5:65E28EFF342B625E79175793FD38F9FD
                                                                          SHA1:08B11474822E670DEAB8F0EA168BAED7D5E3DBE1
                                                                          SHA-256:A2B62C5914DE169A68A018A5B47C1253DBCA10A251862D17B0781ECFD19B6192
                                                                          SHA-512:79641D0E05F81BFB80034937D34E74B7483A790F33C1F9A0FA92C6A7913AC8C03036CFDEFB43850B84EFB3DD3C4A39022DC8F22E5B5DE6353586A546E03A5789
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Universal) $TZData(:Etc/UTC)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Etc\Zulu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):158
                                                                          Entropy (8bit):4.874356623237119
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRaQEBURFB:SlSWB9vsM3yzTHAIgm6N/yRYaRX
                                                                          MD5:EDABCAC858EC9632D5D8DCCFB28F4D6E
                                                                          SHA1:E5BEF1367A97A1900749CE6B1E01CF32F582BDD9
                                                                          SHA-256:BBD6E93206FF3B7017AFBE63905B4C932C422B582F3CE2A79A7B885D390EE555
                                                                          SHA-512:3A22364D423F2F970123561408018A2B72F43C4978836D3B6DF7517217445605838DCB8DDBDA204FD01C49A4A7D5ADAD4CA8BDA7C3B412D54750BAEAA589B683
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Zulu) $TZData(:Etc/UTC)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Amsterdam

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9102
                                                                          Entropy (8bit):3.899679308991091
                                                                          Encrypted:false
                                                                          SSDEEP:96:UvV6eHuZ+y+2KDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:SVJUSs41sFpM5vwA6Efv03TBZLl
                                                                          MD5:262A99D2D471F855C2A3C96CACB0C431
                                                                          SHA1:2CAC8BFAD1A626A189413203ADA2E2B753A6DA69
                                                                          SHA-256:5808F77CAB37ED4F52F0A02FF0B75EA194F8799A2165695CA3650579CAD498D9
                                                                          SHA-512:6DC3BD4177292C07390CD0EC2F672FB6846CEEFA1A2C57B2C8E84CE43C90486544350DA998A5E36CA7A02C46859B4183D829B26013E01071014C6E2849D6573C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Amsterdam) {.. {-9223372036854775808 1172 0 LMT}.. {-4260212372 1172 0 AMT}.. {-1693700372 4772 1 NST}.. {-1680484772 1172 0 AMT}.. {-1663453172 4772 1 NST}.. {-1650147572 1172 0 AMT}.. {-1633213172 4772 1 NST}.. {-1617488372 1172 0 AMT}.. {-1601158772 4772 1 NST}.. {-1586038772 1172 0 AMT}.. {-1569709172 4772 1 NST}.. {-1554589172 1172 0 AMT}.. {-1538259572 4772 1 NST}.. {-1523139572 1172 0 AMT}.. {-1507501172 4772 1 NST}.. {-1490566772 1172 0 AMT}.. {-1470176372 4772 1 NST}.. {-1459117172 1172 0 AMT}.. {-1443997172 4772 1 NST}.. {-1427667572 1172 0 AMT}.. {-1406672372 4772 1 NST}.. {-1396217972 1172 0 AMT}.. {-1376950772 4772 1 NST}.. {-1364768372 1172 0 AMT}.. {-1345414772 4772 1 NST}.. {-1333318772 1172 0 AMT}.. {-1313792372 4772 1 NST}.. {-1301264372 1172 0 AMT}.. {-1282256372 4772 1 NST}.. {-1269814772 1172 0 AMT}.. {-12507

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Andorra

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6927
                                                                          Entropy (8bit):3.8182041031531897
                                                                          Encrypted:false
                                                                          SSDEEP:96:CA34elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:CI41sFpM5vwA6Efv03TBZLl
                                                                          MD5:D897DCA686A03495EB2C3323FAB0BEAD
                                                                          SHA1:1433BC303DE92F7B36F881C8595A42B35E0814FC
                                                                          SHA-256:F0B48DA7CA3659450D87CC0DDFDDFD28B464543DF1EE40D935C44D5CD7C9B9B3
                                                                          SHA-512:A1C4AE1E0EC26B159B0F5D058A7A77B8774F611A4D3C6AECEDD7186957D6BD9F15CDFCBA248FCC8A4B4146BD72CD7D66B9F88A2BF7CDEF416F1831A2F335D48C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Andorra) {.. {-9223372036854775808 364 0 LMT}.. {-2177453164 0 0 WET}.. {-733881600 3600 0 CET}.. {481078800 7200 0 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0 CET}.. {733280400 7200 1 CEST}.. {749005200 3600 0 CET}.. {764730000 7200 1 CEST}.. {780454800 3600 0 CET}.. {796179600 7200 1 CEST}.. {811904400 3600 0 CET}.. {828234000 7200 1 CEST}.. {846378000 3600 0 CET}.. {859683600 7200 1 CEST}.. {877827600 3600 0 CET}.. {891133200 7200 1 CEST}.. {909277200 3600 0 CET}.. {922582800 7200 1 CEST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Astrakhan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2063
                                                                          Entropy (8bit):3.679377249443024
                                                                          Encrypted:false
                                                                          SSDEEP:48:TvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDOP:rCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
                                                                          MD5:CB860328FA96A14055BF51A3B2D35A08
                                                                          SHA1:CFA49DC861F4AC3D29A78D63D71C2D6D83D68F84
                                                                          SHA-256:4B5FB0AF225974D117374028285F20A02B833FF4136E6BFAE7B65E6D6D28829E
                                                                          SHA-512:960152826F4245012462E53F80B69B0C45C27D75D46C70D485674CA19071DF268671C7691B614BE53B9E7BD8CFEC5D24F3DCF933F2F14D827F2A32EB347D7540
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Astrakhan) {.. {-9223372036854775808 11532 0 LMT}.. {-1441249932 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {7

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Athens

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7954
                                                                          Entropy (8bit):3.7252594544513795
                                                                          Encrypted:false
                                                                          SSDEEP:96:1D/8QdzFu+f+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:Z/8ohvyDjivBeRF+W35Syrwl9h5j
                                                                          MD5:8B2C99E1CD04D7559709FDF8D382343C
                                                                          SHA1:C595D5159C742B815AF89EC8604376E01291F9F1
                                                                          SHA-256:47353319419505AAB205C23F8C97EA0B12E5DED2113147794F77B67349AFF52F
                                                                          SHA-512:227CA21A3B6160357988582E261A62AE7B09D46D479EABFAC8039185D710EFA765CD1694F4388EBF8800978A1E1DB69F6AF9BB9BF82C0FCD66E883930E1F8249
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Athens) {.. {-9223372036854775808 5692 0 LMT}.. {-2344642492 5692 0 AMT}.. {-1686101632 7200 0 EET}.. {-1182996000 10800 1 EEST}.. {-1178161200 7200 0 EET}.. {-906861600 10800 1 EEST}.. {-904878000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844477200 7200 1 CEST}.. {-828237600 3600 0 CET}.. {-812422800 7200 0 EET}.. {-552362400 10800 1 EEST}.. {-541652400 7200 0 EET}.. {166485600 10800 1 EEST}.. {186184800 7200 0 EET}.. {198028800 10800 1 EEST}.. {213753600 7200 0 EET}.. {228873600 10800 1 EEST}.. {244080000 7200 0 EET}.. {260323200 10800 1 EEST}.. {275446800 7200 0 EET}.. {291798000 10800 1 EEST}.. {307407600 7200 0 EET}.. {323388000 10800 1 EEST}.. {338936400 7200 0 EET}.. {347148000 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Belfast

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.876296755647751
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQahs3QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/y72
                                                                          MD5:7160C6EE32380846653F016AE8AFD52A
                                                                          SHA1:DE7805089639C54893F2107FA67342DA72A79BBC
                                                                          SHA-256:557023674F6E8376707517103EE69C1DEBBE53CDD4BCAB11E763CC53B9CB1908
                                                                          SHA-512:FDBDECBBDB0C419226E2604608FD2923CFB06E4B6948493208FD83FD796880E81F6147C0FAFEB572079C9C916831B7B055620EC939164CCA1DAF76897BE60F2C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Belfast) $TZData(:Europe/London)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Belgrade

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7309
                                                                          Entropy (8bit):3.8204712502914653
                                                                          Encrypted:false
                                                                          SSDEEP:96:lp+/4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:lY41sFpM5vwA6Efv03TBZLl
                                                                          MD5:02A003411B61A311896A6407B622152A
                                                                          SHA1:3B8BC6D1AF698CE7BB14A08307F5A4295EB8ED03
                                                                          SHA-256:74B225511B518B0CED972CBB33D694697712CCB96A6D81E0F50ADA28CF6E2C92
                                                                          SHA-512:9E03B3EB1E528E5B1ADBA09F808E73BF9C4314EDCBF6F96E46844D51A5F425BED3EE8FD5BA8706C46A7FB9882485F119F81996F2EAB7E1E9B598978C402DDE0F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Belgrade) {.. {-9223372036854775808 4920 0 LMT}.. {-2713915320 3600 0 CET}.. {-905824800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-777942000 7200 1 CEST}.. {-766623600 3600 0 CET}.. {407199600 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 360

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Berlin

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8020
                                                                          Entropy (8bit):3.820756136386754
                                                                          Encrypted:false
                                                                          SSDEEP:96:Pi9+qFR274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:PQs41sFpM5vwA6Efv03TBZLl
                                                                          MD5:84027C3C8315BD479B38DE11F38E873F
                                                                          SHA1:6E92A2A9734A9C6B02ECCD99F114D667C909C5BA
                                                                          SHA-256:7E7111F06288069B52A4E1CA0B016216DF9328FB3B1560A740146497CCDD4D24
                                                                          SHA-512:5FFDE523021FC0C490261F55999204C9CE6C8C274888525EA6EE7C01BC5CCABC7A3877FD454B4167D81F4B89BACB087E8BA6AB0BAC46C2874ED9257BE2092340
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Berlin) {.. {-9223372036854775808 3208 0 LMT}.. {-2422054408 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-776559600 10800 0 CEMT}.. {-765936000 7200 1 CEST}.. {-761180400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717631200 7200 1 CEST}.. {-714610800 10800 1 CEMT}.. {-710380800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Bratislava

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.943205109348136
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVtXrAeovXHAIgoquXrsY6RL/yQahcvEB5yQazXrH:SlSWB9vsM3ymzbAeSHAIgozbsY6N/y7c
                                                                          MD5:C69AB60BE74D4BB7E31BE4E5ECCD8FD2
                                                                          SHA1:9DD0BA6171080F074858EF88ADA2E91C1F465619
                                                                          SHA-256:1D7C539AAA1E3AD5EF3574A629523B5B781F1A91D352C9B39B8DE7316756026E
                                                                          SHA-512:C273B97CCFB5F328EB7A13CCA3126DE8D91B3876CBD248990C0BE063DDBE5B0F31EA138E31A1C5C43B1ABCF42EA511448E6DC589EB99E8172D7C2A68BA31A8E7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Prague)]} {.. LoadTimeZoneFile Europe/Prague..}..set TZData(:Europe/Bratislava) $TZData(:Europe/Prague)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Brussels

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9223
                                                                          Entropy (8bit):3.8450929464870804
                                                                          Encrypted:false
                                                                          SSDEEP:96:RhcSQnG1Czyc1+FdDKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcM:Rh8zyc4Ss41sFpM5vwA6Efv03TBZLl
                                                                          MD5:E6C1153C3F71C8C005D7A46DDF6461FB
                                                                          SHA1:CBDF7D5D36AF57D83859C910B493464617EC9571
                                                                          SHA-256:1402A2072ADC9EBB35F4C0368D2E9A7A11493626C667C022614FFB7CC05B6CB6
                                                                          SHA-512:8B1B47678F75DBE59DB08E034F0701BD11FF4FD3AD0304C8ABF45E848F717D2787B8E47558D3C334D369E0938C633DC217178D3EAE6486CEFBE25CF1668479F6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Brussels) {.. {-9223372036854775808 1050 0 LMT}.. {-2840141850 1050 0 BMT}.. {-2450995200 0 0 WET}.. {-1740355200 3600 0 CET}.. {-1693702800 7200 0 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1613826000 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585530000 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301263200 0 0 WET}.. {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Bucharest

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7974
                                                                          Entropy (8bit):3.7264631277913853
                                                                          Encrypted:false
                                                                          SSDEEP:96:vMSsQMAz5CXNU5paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:vMS1kdUoivBeRF+W35Syrwl9h5j
                                                                          MD5:88DB5686937D3499A8142413B2CF2EB5
                                                                          SHA1:E37BAD2127553600D0E38A43053D1B07B2498DA8
                                                                          SHA-256:C560D45104A8DD73FC7370B5AC1615E22043DBC93DFB46A9ECC6468C2D38B19A
                                                                          SHA-512:375B8A63CFF2E278CD8C78BF9DBC86288FFB1AD57DAED00CD2199F0B05F4FBFA7D17D93C6458B20B86F6D05F3E3A49D594E60AC97DDB47141E21D7CDE10F8456
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Bucharest) {.. {-9223372036854775808 6264 0 LMT}.. {-2469404664 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {296604000 10800 1 EEST}.. {307486800 7200 0 EET}.. {323816400 10800 1 EEST}.. {338940000 7200 0 EET}.. {354672000 10800 0 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Budapest

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8287
                                                                          Entropy (8bit):3.8244305880244567
                                                                          Encrypted:false
                                                                          SSDEEP:96:rHw0+D5xp4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:rQXj41sFpM5vwA6Efv03TBZLl
                                                                          MD5:11468F958796F971ADD5FB1A0C426D78
                                                                          SHA1:3FA58BEF391BCF7BAC6A124D093B6505B4EAC452
                                                                          SHA-256:B58F3E9066B8B57EB037D509636AA67A06ACC8348BE6C48482D87CDC49844A4E
                                                                          SHA-512:0492EABD6EE16392C00A196AF38995E5F9E55E30A82A50EFFB381DC978E9E63E801555CDC219869E6251BD51115972F742D8A7D9524372B8B11702AE4B28BFB7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Budapest) {.. {-9223372036854775808 4580 0 LMT}.. {-2498260580 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1640998800 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1600470000 7200 1 CEST}.. {-1587250800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555196400 3600 0 CET}.. {-906775200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-778471200 7200 1 CEST}.. {-762656400 3600 0 CET}.. {-749689200 7200 1 CEST}.. {-733276800 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-686185200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-492656400 7

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Busingen

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.952483060656419
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQahDZALMFB5h8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/y7D17/f
                                                                          MD5:CED145F8D9B231234E021D2214C1064B
                                                                          SHA1:7B111DC24CA01C78A382CECD3247CF495D71CD34
                                                                          SHA-256:F511A80AB70FF93A0EB9F29293F73DF952B773BB33EB85D581E4FB1FE06E4F05
                                                                          SHA-512:E2323C04BF99909ABA9A09A66F9B4696519B5F9FE3AF178FB04D5E0053F41CAA8B937DC4148954ED093D317F454E0547786BEC934F2ABF22A60AAA6A24E63BF9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Busingen) $TZData(:Europe/Zurich)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Chisinau

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8096
                                                                          Entropy (8bit):3.7635458172251406
                                                                          Encrypted:false
                                                                          SSDEEP:96:jXSsijEpkv2XkN8qc/OyEie8hF5WQ9VX/Zs1cw27oXqdCA5XqjqFLigTE9s5VpJ:jXS+WeUqKie8hF5f9PwdXM9
                                                                          MD5:E7F52393523729CA3916768B3F3B4E55
                                                                          SHA1:1524A3E610DCD33AC0006946BAB2929CA7F5A33F
                                                                          SHA-256:2BD1C0AB412A5E9C97F533C4D06B773D045215B92568A4E89ADC93C7462D62EC
                                                                          SHA-512:218674ECD9FD6C1A1C83EE69AFE6AA5AD0D5A8BB59FF497FDF2573B7CF52DAE98ECE0815CF99668CA4E172FF67D220B227369865076333B3EE802A8839C65279
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Chisinau) {.. {-9223372036854775808 6920 0 LMT}.. {-2840147720 6900 0 CMT}.. {-1637114100 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {-927165600 10800 1 EEST}.. {-898138800 7200 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-800154000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Copenhagen

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7722
                                                                          Entropy (8bit):3.8237774522471564
                                                                          Encrypted:false
                                                                          SSDEEP:96:vFKb+vS74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOR:vFKX41sFpM5vwA6Efv03TBZLl
                                                                          MD5:F9BC892F4BAE6712718C75AA5A07E1C7
                                                                          SHA1:D7BDB30B9E10A7B6FABB5A257F9F6C538C1E3371
                                                                          SHA-256:C6ABC78AD0F03F903E04DB41067B555F9E589E321E253A01ED819189C6FFFC0E
                                                                          SHA-512:A8F8BF7ED070A5DA021BC0A5F87003B7DE433EA66B38A09CA6BDC5F4DC964D35758AE325B0687694AA5F712EF563D1EB8444D11CBDD8332457AB8BBFF8602363
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Copenhagen) {.. {-9223372036854775808 3020 0 LMT}.. {-2524524620 3020 0 CMT}.. {-2398294220 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680490800 3600 0 CET}.. {-935110800 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 0 CEST}.. {-769388400 3600 0 CET}.. {-747010800 7200 1 CEST}.. {-736383600 3600 0 CET}.. {-715215600 7200 1 CEST}.. {-706748400 3600 0 CET}.. {-683161200 7200 1 CEST}.. {-675298800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Dublin

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9810
                                                                          Entropy (8bit):3.7669748644882417
                                                                          Encrypted:false
                                                                          SSDEEP:192:fbxxHZiMU8EKTy74jT56XdEN1+UZBdMN186LPR:fbzZiMUZ6y0jT5bZHMN186LPR
                                                                          MD5:726F01B47BB99952639200AB73E29425
                                                                          SHA1:FF38CF353CE007BE871A27DDF836D198D21F167F
                                                                          SHA-256:930F4E37B6D60B6701CBA95EEA1F6053D85E5F9DE6BBE287A0D43E24B9D63FB0
                                                                          SHA-512:CF3567BCB23C75527F154C987FAFAD09A5E84E0745A3DB55D268688E5BB37D4E17E2D71EF608FA9C1CA99066BD384108AB9F8C7AD5CAC9A95BC6A541B0135699
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Dublin) {.. {-9223372036854775808 -1500 0 LMT}.. {-2821649700 -1521 0 DMT}.. {-1691962479 2079 1 IST}.. {-1680471279 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1517011200 0 0 IST}.. {-1507500000 3600 1 IST}.. {-1490565600 0 0 IST}.. {-1473631200 3600 1 IST}.. {-1460930400 0 0 IST}.. {-1442786400 3600 1 IST}.. {-1428876000 0 0 IST}.. {-1410732000 3600 1 IST}.. {-1396216800 0 0 IST}.. {-1379282400 3600 1 IST}.. {-1364767200 0 0 IST}.. {-1348437600 3600 1 IST}.. {-1333317600 0 0 IST}.. {-1315778400 3600 1 IST}.. {-1301263200 0 0 IST}.. {-1284328800 3600 1 IST}.. {-1269813600 0 0 IST}.. {-1253484000 3600 1 IST

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Gibraltar

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9509
                                                                          Entropy (8bit):3.8837074152297704
                                                                          Encrypted:false
                                                                          SSDEEP:96:QTOKVA1oCobz0W4x2+ZE74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNA:QyoCvTZ641sFpM5vwA6Efv03TBZLl
                                                                          MD5:D04F8EDDA1C3611692FB91E317CCADFE
                                                                          SHA1:1C483FC95459EC6F1D5FE4DD275879A9EBCA1718
                                                                          SHA-256:0524A31131405347C1D5D86C5EE38A2064AB055C030AB3B43F25DB3B28FFD8D2
                                                                          SHA-512:4E2E18EBDE2765F2251B1FE41EF8E6AC79875617348974A28619F5E59EC0467239C682CCE8DEBD7A698BE2F00252C77D1F7FA50B6CAFF920B3BE53A0B836F815
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Gibraltar) {.. {-9223372036854775808 -1284 0 LMT}.. {-2821649916 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Guernsey

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.879252060643389
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQakQAL/yQavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yYU
                                                                          MD5:07AF23DA01CB963EA9E57534E34E7704
                                                                          SHA1:1C4A214FF3B722E80C0ECACA0FFD5DFF302F6AE9
                                                                          SHA-256:F7046808A8E80B7AE449D1A49AE3E480096736B7D3F554A240C7DFB10F82076A
                                                                          SHA-512:713860D340C0EBA5EEF873ECB9B28CCDE9BFAD31B6A8626EF507E96585F5CC1091BF8D8A2DB7E5CB532E44F4561FBAE1797141724EF934755B69919FEA09A78A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Guernsey) $TZData(:Europe/London)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Helsinki

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7368
                                                                          Entropy (8bit):3.7258352536809705
                                                                          Encrypted:false
                                                                          SSDEEP:96:OsR0uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hzj:OkyDjivBeRF+W35Syrwl9h5j
                                                                          MD5:7FF902B06FA79F14553670A70E77FF8C
                                                                          SHA1:0105051541F38956EA6192BD0C7ED4047668005E
                                                                          SHA-256:5B5C0A9261A414EA8DC34F594EE05BEE16F695488B230857D2B569A6B603BC39
                                                                          SHA-512:551940199783A0FF9D73695B77B10300644F50E91D6B02FE79BB0CD4B78C7BA88CCE56F4B9408EC146361BF408F52D01A1F435183360C801EA5E219FB718247F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Helsinki) {.. {-9223372036854775808 5989 0 LMT}.. {-2890258789 5989 0 HMT}.. {-1535938789 7200 0 EET}.. {-875671200 10800 1 EEST}.. {-859773600 7200 0 EET}.. {354672000 10800 1 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {410220000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 EEST}.. {717555600 7200 0 EET}.. {733280400 10800 1 EEST}.. {749

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Isle_of_Man

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.914274131294981
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQaqpfioxp8QavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/ycS
                                                                          MD5:F9A0F19FAF3131D8A70C50FF21B365B7
                                                                          SHA1:7FC2B5302FAD06BC4C633CD22A80A7D40073FFF8
                                                                          SHA-256:2F1151B0528A5325443379D4E7CCE32C00213722AD9DF764E1DC90198084B076
                                                                          SHA-512:6D04DF4480FE132A6641C4BF7E01936E2E4A71A3A6C2AB9F7DA7A9D8A4B836BC66EE2BB597B8C318D07A06F72C05B07E6785B53308ED9BC1103AE6DBDD0FF24E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Istanbul

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3683
                                                                          Entropy (8bit):3.814835316757376
                                                                          Encrypted:false
                                                                          SSDEEP:48:Qi0p05zvSPBUUl0ZFzo4ay0CREDcxn6nH78BV0QbCgkCPviiM0H7hdli80+j7x9L:Qiq66OFEIFMssCfMsXV3heM2MRlA0
                                                                          MD5:A8256656B971F58CB991BC270BF93B26
                                                                          SHA1:189796E1B8E29A7A7B8B0E143DD9B44BAF217AB2
                                                                          SHA-256:08061A80FC0F1EF375EEFE784EACDF0812E289FD67E8613BDEC36209985CA1D7
                                                                          SHA-512:1F11308B5BAC1F3DB75CAC7322BBEA6E51C6B4A2A3450F1DB84DE6AA127F0F1BAA7DAB409FAF1288C100BDA77DA6FA1C6E3C0BA962F9406D1445D7C9E2AA3A60
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Istanbul) {.. {-9223372036854775808 6952 0 LMT}.. {-2840147752 7016 0 IMT}.. {-1869875816 7200 0 EET}.. {-1693706400 10800 1 EEST}.. {-1680490800 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1440208800 10800 1 EEST}.. {-1428030000 7200 0 EET}.. {-1409709600 10800 1 EEST}.. {-1396494000 7200 0 EET}.. {-931053600 10800 1 EEST}.. {-922676400 7200 0 EET}.. {-917834400 10800 1 EEST}.. {-892436400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-764737200 7200 0 EET}.. {-744343200 10800 1 EEST}.. {-733806000 7200 0 EET}.. {-716436000 10800 1 EEST}.. {-701924400 7200 0 EET}.. {-684986400 10800 1 EEST}.. {-670474800 7200 0 EET}.. {-654141600 10800 1 EEST}.. {-639025200 7200 0 EET}.. {-622087200 10800 1 EEST}.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Jersey

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):181
                                                                          Entropy (8bit):4.8801202136140915
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQap6cEBx/yQavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yzx
                                                                          MD5:FE10770868A75F4F8D76C5E23D99AA81
                                                                          SHA1:30AC768BA47AF7A53831F5142B58ECEC41933621
                                                                          SHA-256:97EB33915ED7C9C34144F8F42357FAB2262B3CD45287F3CFFD26C33D65F7651E
                                                                          SHA-512:1D82DF45AB0CCDFBFAD0431C668794996E01776800F34DD4131C5287D37291657A749D497AA5B0AB81CAFF3190896633FBFF456BFFEB7E93A3420AA841E54842
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Jersey) $TZData(:Europe/London)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Kaliningrad

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2512
                                                                          Entropy (8bit):3.941165221943348
                                                                          Encrypted:false
                                                                          SSDEEP:48:coNlj+X2uxhuHJkw0QqXknzaVV04v3TfdGY3kNmneVuNlh000sGpdh:coN9+1EpkwCXkSV3A8qc0
                                                                          MD5:104CCB93300F40BAF8F4D7CC882EFC05
                                                                          SHA1:EA83F3C3791BD6F083844939DC405B248E738FE3
                                                                          SHA-256:2387D26DF5429DF9867F42F7D4F872DC146643B4B3CC57DA7298C18561DE8BFE
                                                                          SHA-512:12724C5BBEE0835626A98B66BF55C3DF1311F07018C70D76FC5C50E7E7BA5C4A9F064D9EDC376CC3B06C4FFFECA3FAF5B66948615A03DFECA7C361E326D950EA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kaliningrad) {.. {-9223372036854775808 4920 0 LMT}.. {-2422056120 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780368400 7200 0 EET}.. {-778730400 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-749095200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Kiev

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7453
                                                                          Entropy (8bit):3.762620506765216
                                                                          Encrypted:false
                                                                          SSDEEP:96:j3C1LyEpkvIpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:j3C9VWdivBeRF+W35Syrwl9h5j
                                                                          MD5:1F0C92A6E5C6BAD82AD7E35814ACC388
                                                                          SHA1:F29C94DF4EE211481051186BBE5CD77EEDC6C33F
                                                                          SHA-256:08B137B7B933393F8F4574615A370013288E5297937B5C59D4179744273FAB26
                                                                          SHA-512:88E8B89439022D219D752340E28C21E461D8E288DA135DA4765C87037B610515E6D9E1B716707025B5BAE652FA2F2A89577949C8A923E5C8667AA6CB5C1BAD7A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kiev) {.. {-9223372036854775808 7324 0 LMT}.. {-2840148124 7324 0 KMT}.. {-1441159324 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-892522800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-825382800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {638319600 14400 1 MSD}.. {646786800 10800 1 EEST}.. {686102400 7200 0 EET}.. {701820000 10800 1 EEST}.. {7175

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Kirov

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2029
                                                                          Entropy (8bit):3.668326642402654
                                                                          Encrypted:false
                                                                          SSDEEP:48:FFvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDM:FhCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
                                                                          MD5:57BB199152815B12FE4491C92FE25186
                                                                          SHA1:7BC5ECDE9EFADE812AF40CB92CCE5323FB57C78D
                                                                          SHA-256:60884D4B8B17A9AB8FB5697DA95F62E570755348109C661D783D56CD047BBE9E
                                                                          SHA-512:2043FDBA860E8F6578F7E26A80C7787B82C7D15188327923EC36D153FDF9BEEAE063012ACE4309B76DB9DBA2DFFB7404DE370BA85023CCE93159FCAD3B9B92B5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kirov) {.. {-9223372036854775808 11928 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {78044

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Lisbon

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9878
                                                                          Entropy (8bit):3.8275310275285723
                                                                          Encrypted:false
                                                                          SSDEEP:192:j76abXsyZLEjx82YbtIaFF1w0us4qE3+sSGjT:j77bXsyZLEjx82atysLE3+sSGjT
                                                                          MD5:0DA331C2A815739E6758797BD24554EA
                                                                          SHA1:3829C441E908BEFDC4ED6AB65FD4ACD0C97D5E1B
                                                                          SHA-256:9FAC9812411F88014779D34722F3E0D2750E45BF21595DF1AE14CB9CCFD3F33F
                                                                          SHA-512:FEBBA05F64AC1F3066AF6351493DD89768154FD171D447503DAEDB90D16858BEDBCE4A74E24AC0C37B5FF191692AF44AADDE4A92E752F88C48DA646352AD9A0B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Lisbon) {.. {-9223372036854775808 -2205 0 LMT}.. {-2713908195 -2205 0 LMT}.. {-1830384000 0 0 WET}.. {-1689555600 3600 1 WEST}.. {-1677801600 0 0 WET}.. {-1667437200 3600 1 WEST}.. {-1647738000 0 0 WET}.. {-1635814800 3600 1 WEST}.. {-1616202000 0 0 WET}.. {-1604365200 3600 1 WEST}.. {-1584666000 0 0 WET}.. {-1572742800 3600 1 WEST}.. {-1553043600 0 0 WET}.. {-1541206800 3600 1 WEST}.. {-1521507600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1426813200 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1221440400 3600 1 WEST}.. {-1206925200 0 0 WET}.. {-1191200400 3600 1 WEST}.. {-1175475600 0 0 WET}.. {-1127696400 3600 1 WEST}.. {-1111971600 0 0 WET}.. {-1096851

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Ljubljana

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.948438246006353
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQavPSJ5Qahs0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNl
                                                                          MD5:56C6C95484FEAF9BAF755683E7417B58
                                                                          SHA1:A43176BEBC5B4D7144A7E1109E0AAEFD95C21EC6
                                                                          SHA-256:713A842197516D618F2D86977262542A1CA334D7DF6026539FA2F2980DBF4CD3
                                                                          SHA-512:566B6DF2D76A8A4D3405C4785C7A471A23D65CD8838831BD0DEDF5BF194E8A3B304CA9920CB4A8EC9D6CD60EAA9BE0335E38D9547A4D23C7E4E5E5A39A09DDAC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\London

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):10211
                                                                          Entropy (8bit):3.826887992237191
                                                                          Encrypted:false
                                                                          SSDEEP:192:GNoCvTZtcf80KYiK3BG0Myj9TYQOeMAwbccM0Fp:GNNTZtcf15iOBG08eNwbccM0Fp
                                                                          MD5:0625C99E16D3C956DED1C0C0F867DEC3
                                                                          SHA1:6ACDF0DB619B63E21EC89046B9320A85FBD3397A
                                                                          SHA-256:D04C4E25DF4DE1C1CFE1EF84B3B6DD746CF08A271AB0958F22C7D580A3ED10E6
                                                                          SHA-512:07AC42F0635DF01CC0AFD13F9668B143D4943BA0E4C377D254B5AF034D9DDBAB77BA813187E9AB73D2EEAD86EBAA26DC15599FD74FC82EEF287F5A6AB9C01635
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/London) {.. {-9223372036854775808 -75 0 LMT}.. {-3852662325 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Luxembourg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9139
                                                                          Entropy (8bit):3.8497931755359303
                                                                          Encrypted:false
                                                                          SSDEEP:96:TkR06ZldaKsc1+FpbdKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiT1:wxRscASs41sFpM5vwA6Efv03TBZLl
                                                                          MD5:789594ED1BB0EDA605DFB567C1E7FE9E
                                                                          SHA1:66C7116CCBED0917A429BB277CF4E0B3361A5B41
                                                                          SHA-256:380E49D38F6ABE946A90A9343A277ED28492EB800747D6D14F4639FD3EA80EDE
                                                                          SHA-512:62CC68E72E79B7A377EAFE92B64D829CD5B9651FCA6782DEF4886C91BB9DF5FCFCD0CF8C5C7628F49E8C523A4AF917DA2745ABA56107683CA014C3E0254E780E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Luxembourg) {.. {-9223372036854775808 1476 0 LMT}.. {-2069713476 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1662343200 7200 1 CEST}.. {-1650157200 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1612659600 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585519200 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552258800 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520550000 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490572800 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459119600 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1411866000 3600 1 WEST}.. {-1396224000 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269813600 0 0 WET}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Madrid

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8517
                                                                          Entropy (8bit):3.8326167134909177
                                                                          Encrypted:false
                                                                          SSDEEP:96:k5m01LdXKc0TJp+bwS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:+DaNVLSs41sFpM5vwA6Efv03TBZLl
                                                                          MD5:63263380F57B756A1DFA3796E4188CD3
                                                                          SHA1:8EEE707AC4FEA1C098C81AC2D289A46239121A5E
                                                                          SHA-256:5337C9843C56DEEC6B91C4468C76EC1C896E80421B72B583B69DE5579063E09A
                                                                          SHA-512:ACA4830020715C471741E27EB2292ACF002D2CD7EDCD1061978B64967EB447F61AA095F960D8A75A01B9B87558D83FF409F30BDACA83E063024F1E2381FA64C4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Madrid) {.. {-9223372036854775808 -884 0 LMT}.. {-2177452800 0 0 WET}.. {-1631926800 3600 1 WEST}.. {-1616889600 0 0 WET}.. {-1601168400 3600 1 WEST}.. {-1585353600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269820800 0 0 WET}.. {-1026954000 3600 1 WEST}.. {-1017619200 0 0 WET}.. {-1001898000 3600 1 WEST}.. {-999482400 7200 1 WEMT}.. {-986090400 3600 1 WEST}.. {-954115200 0 0 WET}.. {-940208400 3600 0 CET}.. {-873079200 7200 1 CEST}.. {-862621200 3600 0 CET}.. {-842839200 7200 1 CEST}.. {-828320400 3600 0 CET}.. {-811389600 7200 1 CEST}.. {-796870800 3600 0 CET}.. {-779940000 7200 1 CEST}.. {-765421200 3600 0 CET}.. {-74849

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Malta

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8724
                                                                          Entropy (8bit):3.816380386871747
                                                                          Encrypted:false
                                                                          SSDEEP:96:KAGvi2GmkwwnpH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZN:KLsww141sFpM5vwA6Efv03TBZLl
                                                                          MD5:9B09D6EED8F23BAFFB62929C0115E852
                                                                          SHA1:4AEF15333C73C2836C09D818FD0E20440D7C4780
                                                                          SHA-256:C5C240BAAECE8235D1FBDD251C1A67CB2D2FC8195DD5BBE37FF9CFF0445FCDA2
                                                                          SHA-512:43AA3492BD335A290C6EFEE275B47EA18E544199E37A9BBAE2E350D42BDFF42F0E9ED461A4BB1824CA33F84A90D4060906844A3E22DA49C9821E4CB460832D6E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Malta) {.. {-9223372036854775808 3484 0 LMT}.. {-2403478684 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812588400 7200 1 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 3600 0 CET}.. {-81997200 7200 1 CEST}.. {-71715600 3600 0 CET}.. {-50547600 7200 1

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Mariehamn

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.959733196757503
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV1AYKjG5XHAIgoq2AYKjo0ARL/yQausWILMFJ8QaC:SlSWB9vsM3ymrAdjGJHAIgorAdjo0ANn
                                                                          MD5:C1844961691214F6E6DF6487788A7758
                                                                          SHA1:6D08E9FB7B8602A80622148BFACD9676F45F0E2B
                                                                          SHA-256:6136C3CFA4A767E7C9DDA23A283AD98B72E9868F192E6A8E3BFE6396F6989BD1
                                                                          SHA-512:B2D1EA51AC5B34792AC02820A9D60FD41F3B91AB6505896476FCB0DC339B8DC1DE9E2C89A7627F69E16247661AE8040D789FFD2F8F1CD59F243B57C4845B450F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Helsinki)]} {.. LoadTimeZoneFile Europe/Helsinki..}..set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Minsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2177
                                                                          Entropy (8bit):3.9354590900153172
                                                                          Encrypted:false
                                                                          SSDEEP:48:K8cVnR7xhuHJkminzaVV04v3TfdGY3kNmneVuNlh000sGpde:5mnRtEpkmiSV3A8qcN
                                                                          MD5:9C10EAE9FA0DE192C5FD4F76E12606F0
                                                                          SHA1:AFD5650410EC3E6ED564A8B2ABF91709D090B4AD
                                                                          SHA-256:8C95EA696EA578DEF726502AC181AF475A676030878F56B4E2D667757BBD1C49
                                                                          SHA-512:3B9ED6B68858485B9A46A0863B7D9D3C1E4C5BBA269457F24A9A12C274F0F9B35E63D8C25EB53E7200DB57DD35ACCB7FD7D8AB005FEE2C4D7FC6E72E8CF57194
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Minsk) {.. {-9223372036854775808 6616 0 LMT}.. {-2840147416 6600 0 MMT}.. {-1441158600 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-899780400 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-804646800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {670374000 7200 0 EEMMTT}.. {670377600 10800 1 EEST}.. {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Monaco

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9186
                                                                          Entropy (8bit):3.856050322706834
                                                                          Encrypted:false
                                                                          SSDEEP:96:2d4STO1C+4qoM9JfKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcot:wvp+hSs41sFpM5vwA6Efv03TBZLl
                                                                          MD5:859DF194457CED25EA3EC247CDEA5025
                                                                          SHA1:970579F53446EBE50438CC3582D88094C7D7DEEB
                                                                          SHA-256:654B92E8B9E8FBDC967D094B48110908F458454D7057F680AC745B9C8D48FCC1
                                                                          SHA-512:3E589FC8CA5E0B0F7F6F17A6983813460AB7E07B9B631D8380836F00A8288FF80650D4139B2A6DEDFF245DE571C7726E087DFF3E6F5F9E7E9C9DFE72B839DC7A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Monaco) {.. {-9223372036854775808 1772 0 LMT}.. {-2448318572 561 0 PMT}.. {-1854403761 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Moscow

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2430
                                                                          Entropy (8bit):3.942836780611272
                                                                          Encrypted:false
                                                                          SSDEEP:48:7fnjazk7e+LxhuHJkvVineTeCTU50x0Y7:7fnjazk7eoEpkvVieTeCTUax0Y7
                                                                          MD5:4547D47E9364ACAFB2A4BEE52D04BFBB
                                                                          SHA1:1E7F964692F81D49AEAF581FE70AD22D4E36226B
                                                                          SHA-256:31F9C3C2F17B3EE4FA6D9EE6A86BF407AC0377DE4D666C65E86CE5AC591F829F
                                                                          SHA-512:7F1D7C80A1BF611D5440EEF9085DA6CDED86B5EF4C2737C105640030E5AA998A0951182E72DC224190A25DA8846CDE856A78EBAA8876AA0B18B1CBCADBB060FF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Moscow) {.. {-9223372036854775808 9017 0 LMT}.. {-2840149817 9017 0 MMT}.. {-1688265017 9079 0 MMT}.. {-1656819079 12679 1 MST}.. {-1641353479 9079 0 MMT}.. {-1627965079 16279 1 MDST}.. {-1618716679 12679 1 MST}.. {-1596429079 16279 1 MDST}.. {-1593820800 14400 0 MSD}.. {-1589860800 10800 0 MSK}.. {-1542427200 14400 1 MSD}.. {-1539493200 18000 1 +05}.. {-1525323600 14400 1 MSD}.. {-1491188400 7200 0 EET}.. {-1247536800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Nicosia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):179
                                                                          Entropy (8bit):4.7873368289068905
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85GKLlXHAIgNwMGKLZRRL/yQatHefeWFKYGKL8n:SlSWB9vsM3yZdL1HAIgGMdLZRN/y3HeA
                                                                          MD5:BE82205480617CF07F76BA0DF06C95BC
                                                                          SHA1:46D2D8D9FE4FB570C2A09BC809B02C8960F9601F
                                                                          SHA-256:FC93B7516933EDFDC211AC0822EE88BF7ACAD1C58A0643B15294F82EB0F14414
                                                                          SHA-512:F490A70053A6011D80FB0A4E96D2871BFEEB168690E21C4EC31F2F5C0E24A67C706528C81322A1D48E71242F0FFA277550192925FDE5B1F34BFCB308290E11FC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Nicosia)]} {.. LoadTimeZoneFile Asia/Nicosia..}..set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Oslo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7922
                                                                          Entropy (8bit):3.818430983275607
                                                                          Encrypted:false
                                                                          SSDEEP:96:MC+4twRQqvSO774elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:MXRQqvSOv41sFpM5vwA6Efv03TBZLl
                                                                          MD5:9923D3F3C50D2BD96BD36558FBCD8E92
                                                                          SHA1:56584B8B9CB27B0ADCAD490C029EE58308C4D7C5
                                                                          SHA-256:5A28B5CEC79B57D4856E3F05615245E6F74DF6388B48BF3F605B792CA3BD972D
                                                                          SHA-512:1FA928EA5F468F2B4AA40B6B73CE6E42267832413B333C399431FE08C6CB4FD4BDD7E3DB15682C76E5EDEB5849224F1EE5B9667E68A8C5C89AF09B075E4F7755
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Oslo) {.. {-9223372036854775808 2580 0 LMT}.. {-2366757780 3600 0 CET}.. {-1691884800 7200 1 CEST}.. {-1680573600 3600 0 CET}.. {-927511200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-340844400 7200 1 CEST}.. {-324514800 3600 0 CET}.. {-308790000 7200 1 CEST}.. {-293065200 3600 0 CET}.. {-277340400 7200 1 CEST}.. {-261615600 3600 0 CET}.. {-245890800 7200 1 CEST}.. {-230166000 3600 0 CET}.. {-214441200 7200 1 CEST}.. {-198716400 3600 0 CET}.. {-182991600 7200 1 CEST}.. {-166662000 3600 0 CET}.. {-147913200 7200 1 CEST}.. {-135212400 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Paris

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9152
                                                                          Entropy (8bit):3.8506895725632746
                                                                          Encrypted:false
                                                                          SSDEEP:96:fySTO1C+4qoMYOKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdi:fdp+3Ss41sFpM5vwA6Efv03TBZLl
                                                                          MD5:9CAF8C5C5AF630E7F782C0480DD786E7
                                                                          SHA1:9FBEF9EEDD8BAFB48B17E3AC388CFEF8DCD10CB0
                                                                          SHA-256:AE61491C4A587F56426A9F2118E31060276F2B0231E750C461781577551CA196
                                                                          SHA-512:F809744BB597184A2815758A27B6A07C515C65DB96CFFB3625FD059DEBBF05EE903E999483B3459C7C8D3991824746F8530CD1378F8A63B1F54F60CFACE9F89B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Paris) {.. {-9223372036854775808 561 0 LMT}.. {-2486592561 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800 3

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Podgorica

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.910162937111088
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQazKIGl1/yQ0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNK
                                                                          MD5:52C36955D6BD1D9FE9CB64822D04B6DB
                                                                          SHA1:D5FF82EC486409E6FB314AD5ACE608577C9632CF
                                                                          SHA-256:B87630FF459DE07EB16CD0C2452660772E3FFC4EEB8419EA77A013B6F63A5900
                                                                          SHA-512:ABA49D3F05A41A4982600E4DA5C225D8994251F447401EE6FE8478E008BCD5D41C057034185B5CFF805634D571F3CC98EFE98093ABC8E6271351E11A4DA1E7AD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Prague

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8038
                                                                          Entropy (8bit):3.8240363895915914
                                                                          Encrypted:false
                                                                          SSDEEP:96:Kr9+neXAS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlh:KnASs41sFpM5vwA6Efv03TBZLl
                                                                          MD5:828134FA1263FEFA2B06A8B2F075F564
                                                                          SHA1:4B332DE6E0855F8B9517F7098A3FB439671FC349
                                                                          SHA-256:5D3AFED5C1B07C6C6635D6BDEB28A0FB4D11A61F25F26C91227B2254BE5F4AA0
                                                                          SHA-512:9AB1462CDBD7F13F0CECDCCC2D91A85D8C0576B71508F935D26638C25ED023CF8FF4BA4FFDA402B308E6142B135D1B9D88700A519DBE2381E8E945329A5354F7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Prague) {.. {-9223372036854775808 3464 0 LMT}.. {-3786829064 3464 0 PMT}.. {-2469401864 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-777862800 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-746578800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-728517600 0 1 GMT}.. {-721260000 0 0 CET}.. {-716425200 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654217200 7200 1 CEST}.. {-639010800 3600 0 CET}.. {283993200 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Riga

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7658
                                                                          Entropy (8bit):3.7750218768791806
                                                                          Encrypted:false
                                                                          SSDEEP:96:eq+cEpkjXkSV385aNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:ePWjUS7ivBeRF+W35Syrwl9h5j
                                                                          MD5:0D3C919F60081388524BD5DB22E6904B
                                                                          SHA1:6691EAB901C8B57D2F2693120A45A67799D05FCB
                                                                          SHA-256:8B64A42BAFD90F9255CACFDBAC603D638DD7C18DC27249F9C9B515E1DA634424
                                                                          SHA-512:62A2820B8C1C5468AC1F1BB626F9AAAD0BA1DEC5B73740F00FE4DB8CFA3F2BCF9947968E693824FC8770BA20AB962F93F7E5E345AE8A85F99CDB18E2B510308E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Riga) {.. {-9223372036854775808 5794 0 LMT}.. {-2840146594 5794 0 RMT}.. {-1632008194 9394 1 LST}.. {-1618702594 5794 0 RMT}.. {-1601681794 9394 1 LST}.. {-1597275394 5794 0 RMT}.. {-1377308194 7200 0 EET}.. {-928029600 10800 0 MSK}.. {-899521200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-795834000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {6

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Rome

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8813
                                                                          Entropy (8bit):3.8168470239811736
                                                                          Encrypted:false
                                                                          SSDEEP:96:hhGvC2GmkNXEq74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:hUsF41sFpM5vwA6Efv03TBZLl
                                                                          MD5:C4F49446D3696301EDB339691DCB2FDB
                                                                          SHA1:537963A77B9BE9BE6B997A812A6E6DD120F6F247
                                                                          SHA-256:DCD2D9144507311E573568598E1FFD0E0574FB677AA0DAFC5641D80A19EB6E58
                                                                          SHA-512:1F0A9A549FA0995C51E90AC392671E3F09744B268F1EE6A27CA7E3C41C2B02A4BA0F98369BE40BA482FBA1FED8F1EE712F0B3217AD86164D1AD498E369C24D76
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Rome) {.. {-9223372036854775808 2996 0 LMT}.. {-3252098996 2996 0 RMT}.. {-2403565200 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-830307600 7200 0 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-807152400 7200 0 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 36

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Samara

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2118
                                                                          Entropy (8bit):3.664269700453612
                                                                          Encrypted:false
                                                                          SSDEEP:48:7PvCAs6kKR6aQmF1cSNWrI+AjQnTRYZ/YF0LUdt/LkajuZbIJltiabs2Tb:7HCAs6kC6aZF1cSN4I+AjQTRYZ/YF0Lw
                                                                          MD5:965D987F6576F66A08871697144D4CDB
                                                                          SHA1:AF7226DF81C2B3C3A5832F59FC708A6BCBF389CA
                                                                          SHA-256:8F395352AA05D35E7D13380E73659A0D5B56FFC17E3F4E40E4F678A902F0E49B
                                                                          SHA-512:B82E0CFA5EDA0FCDF03609AE439255F8937A7E9EFA0AFE15EA8877316782AFC74514BCD2B4F06F1B5F0F3C5A64A933D73CB50D5AED2BB1491BD6CACBB77B10E8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Samara) {.. {-9223372036854775808 12020 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-1102305600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 10800 0 +03}.. {687916800 14400 0 +04}.. {701820000 18000 1 +05}.. {717544800 14400 0 +04}.. {733

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\San_Marino

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):179
                                                                          Entropy (8bit):4.955758257767983
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQawELDX7x/yQaxE:SlSWB9vsM3ymx5PHAIgoxvN/yt/yrE
                                                                          MD5:D253DA6880630A31D39DB0CFA4933ABD
                                                                          SHA1:E5798DAAE574729685FE489F296B964BC1CCF2E4
                                                                          SHA-256:B6856A0E38C2404F7D5FA1821559503F8AE70923A562F0D993124D131515F395
                                                                          SHA-512:CFB6005F3E8D1C585AF36EB7A8C9F49760EF6F446C97E7804EB61EFD0804424C4FB6AE81B71C5A867274EF89A17DAC0D2A0FF882A0F6AEA1D5FFD51593726C5F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/San_Marino) $TZData(:Europe/Rome)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Sarajevo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.937834327554967
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawEX3GEaQa5:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNZ
                                                                          MD5:F7C7DAE9C5D371EF9EE1F490246ED3CC
                                                                          SHA1:40C388FE2A55078C8E0524A4385B3F8846960E24
                                                                          SHA-256:BC00D953C2F3E55E40EDA13838AB66B9E9D0BDAD620E4EB917637761ABB06FB1
                                                                          SHA-512:EB22C59F4D58D96797A718FC59B010795F587626E456D44A3E6398E0FBF4ECD97BCDC151BC1359151798B5AF2964FE5708233F8ECD0D344C3E27629F2645687F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Saratov

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2061
                                                                          Entropy (8bit):3.6638125261109824
                                                                          Encrypted:false
                                                                          SSDEEP:48:yFvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDQ:yhCAs6kC6aZF1cSNcjXgV/ApDFjDQ
                                                                          MD5:CC4D7C478790588D232568CAB12D8E67
                                                                          SHA1:07A7CFCFFFF91D124EDFC99F5053BAFC79FBB12B
                                                                          SHA-256:AB90363DEE5077C39EC55FE8E519593FF08223E5A8E593F6CCE01FB5B8B35BAE
                                                                          SHA-512:23944D20624C942CFDE58F1019160D64401BD0AFB8C3EC49F904038482FAA6741812548C860A2DAE050B8D17A7E08ED9C6EBE7FF19393CFA46D78B1D21B1CACA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Saratov) {.. {-9223372036854775808 11058 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {780

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Simferopol

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2389
                                                                          Entropy (8bit):3.9502615086649637
                                                                          Encrypted:false
                                                                          SSDEEP:48:wM2wE0xhuHJkN+2kCnbdSisa0ewEKGfUslIYtq8X:UwEAEpkuCgaNl7
                                                                          MD5:1953A171614196D2FD2CA12FFE6F70D4
                                                                          SHA1:20958D5888F94C1FF2C90DDB97915435095AA67C
                                                                          SHA-256:4186A873A6218FF746957A0AAED1D61FC28FF5ED6D44BF38F36B5120A21C06C6
                                                                          SHA-512:35A628EBB2C2068A7DE07175494E195D75ADE30CB4B8BFE7EE7EA0A3B30F68BF6E0F21590A0A2DA0E02B944473545A5887BF95692A9C9E9DCD08CB8D542D142B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Simferopol) {.. {-9223372036854775808 8184 0 LMT}.. {-2840148984 8160 0 SMT}.. {-1441160160 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-888894000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-811645200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 7200 0 EET}.. {694216800 7200 0 EET}.. {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Skopje

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):187
                                                                          Entropy (8bit):4.953089768975736
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawOgpr8Qahr:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNO
                                                                          MD5:0BF8ADBB63F5D6187C75FF1B0BAC761E
                                                                          SHA1:7DE15E767D34812F784CE6E85438A592E2CBA418
                                                                          SHA-256:52F20858433261B15797B64F0A09CEE95D552EF93B5DAA7C141BFAB6D718C345
                                                                          SHA-512:27D395635427C8FA1A4E0063A32F482701D2CC7C7724B4A06E661D4A419D23E219672888D37367FE5E70B6872914EB9EE034AE359DCB6A4C4CE05CA34C3589A9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Sofia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7654
                                                                          Entropy (8bit):3.727428614069594
                                                                          Encrypted:false
                                                                          SSDEEP:96:8lmG4+K7Gjz5CXNUatpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:8lmGWwkdUasivBeRF+W35Syrwl9h5j
                                                                          MD5:91357DFC23ADB0CE80C463E4B6D896BE
                                                                          SHA1:273F51BE4C67A9AC1182F86AC060E963684151D5
                                                                          SHA-256:6415F279CB143EA598CF8272263AC5B502827B10CEEB242B39E6EFCC23A2EE12
                                                                          SHA-512:8EA7E2D4C2239879A4D6CCE302C38A6D2A9093A2CADEF4F4294E60D373AB9A2C468BA6E3D54DEC7F73D954CE5226EF2B022F8BDEF29B3B4AAB3838B05C72EA29
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Sofia) {.. {-9223372036854775808 5596 0 LMT}.. {-2840146396 7016 0 IMT}.. {-2369527016 7200 0 EET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-781048800 7200 0 EET}.. {291762000 10800 0 EEST}.. {307576800 7200 0 EET}.. {323816400 10800 1 EEST}.. {339026400 7200 0 EET}.. {355266000 10800 1 EEST}.. {370393200 7200 0 EET}.. {386715600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465350400 7200 0 EET}.. {481075200 10800 1 EEST}.. {496800000 7200 0 EET}.. {512524800 10800 1 EEST}.. {528249600 7200 0 EET}.. {543974400 10800 1 EEST}.. {559699200 7200 0 EET}.. {575424000 10800 1 EEST}.. {591148800 7200 0 EET}.. {606873600 10800 1 EEST}.. {62259

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Stockholm

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7308
                                                                          Entropy (8bit):3.817544865319589
                                                                          Encrypted:false
                                                                          SSDEEP:96:Skhe74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:Sky41sFpM5vwA6Efv03TBZLl
                                                                          MD5:A17318A055D4BB049FB4621CDC2AFED3
                                                                          SHA1:61BA62F253BD4D8B34C2CFCDB96AB458D413E214
                                                                          SHA-256:12447CE016745FC14584CB5F753E918C23ECA5D028CA50042E0714CF3783608A
                                                                          SHA-512:90CF037C1DBF55C5D70164D2B2CBDC9580F7FE496279416F578E42A444AD6CEBFF29336921619AAFC4E872B886A9AC5EF45006D2B9585D17AA3864F773C89610
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Stockholm) {.. {-9223372036854775808 4332 0 LMT}.. {-2871681132 3614 0 SET}.. {-2208992414 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Tallinn

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7549
                                                                          Entropy (8bit):3.76585669030767
                                                                          Encrypted:false
                                                                          SSDEEP:96:dUusEpkjXkSV3AMaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:O0WjUSWivBeRF+W35Syrwl9h5j
                                                                          MD5:54EF0224F5E28FA78F212EC97D4AE561
                                                                          SHA1:FA7C9A951ED943F1E1E609D2253582016BC26B57
                                                                          SHA-256:6F3594CCDA78B02B2EE14C8FAE29E668E47193AF2DFCF5AF1ECD210F13BCE9CE
                                                                          SHA-512:2D1CA2BB1945AE5E3F56AF8FA7F950CE7169F215C783E683634581C5EC01B54159E47A0E9551897077BBEAB06158906029A4E4B0051A263D9E5D903EA9DA1692
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tallinn) {.. {-9223372036854775808 5940 0 LMT}.. {-2840146740 5940 0 TMT}.. {-1638322740 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1593824400 5940 0 TMT}.. {-1535938740 7200 0 EET}.. {-927943200 10800 0 MSK}.. {-892954800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-797648400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 10800 1 EEST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Tirane

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7675
                                                                          Entropy (8bit):3.809498345470167
                                                                          Encrypted:false
                                                                          SSDEEP:96:n05NWKIHBJ9AE4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt:0iKqxAE41sFpM5vwA6Efv03TBZLl
                                                                          MD5:1983B88075A92942209BB2B80E565F4E
                                                                          SHA1:12A0401026C5C036144FD1D544173AAB39969F61
                                                                          SHA-256:C62686BF598138FEFB72E8CC6632BA75A5FE147F2A30124EE3583BE1F732E38D
                                                                          SHA-512:E95C38FA0A2B526C00B9DCF5CDF53059DECF64B085AA18BE000968DA626561944415D053CF7A5C32BC672085538920CFD67A3A3B627CFD5B1A4C9CEC49AA3F96
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tirane) {.. {-9223372036854775808 4760 0 LMT}.. {-1767230360 3600 0 CET}.. {-932346000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-843519600 3600 0 CET}.. {136854000 7200 1 CEST}.. {149896800 3600 0 CET}.. {168130800 7200 1 CEST}.. {181432800 3600 0 CET}.. {199839600 7200 1 CEST}.. {213141600 3600 0 CET}.. {231894000 7200 1 CEST}.. {244591200 3600 0 CET}.. {263257200 7200 1 CEST}.. {276040800 3600 0 CET}.. {294706800 7200 1 CEST}.. {307490400 3600 0 CET}.. {326156400 7200 1 CEST}.. {339458400 3600 0 CET}.. {357087600 7200 1 CEST}.. {370389600 3600 0 CET}.. {389142000 7200 1 CEST}.. {402444000 3600 0 CET}.. {419468400 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {457480800 7200 0 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 C

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Tiraspol

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.906212162381389
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV+NM/LWXHAIgoq9NM/HARL/yQa3MPgJM1p8QagNMj:SlSWB9vsM3ymI6CHAIgoI6HAN/ytM4MO
                                                                          MD5:E0C99DB7673EEE440BA1848046455BA1
                                                                          SHA1:1BCCC1BE46306DEF8A9CA249DE8FA11FC57CC04D
                                                                          SHA-256:FDD53FDB5F754BBBA8FF98F0B1555FE0BAEB7852843220A7CF93A190B641A9AD
                                                                          SHA-512:CD56B540AE9084DEAA9D0A1DBBAF89733C465424C22CE74696B9AE90FD4FEFAB265CF23C5B13A7F04597D75FD0147BD593E0552B56D87372170CB4CA1BFC8259
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Chisinau)]} {.. LoadTimeZoneFile Europe/Chisinau..}..set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Ulyanovsk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2119
                                                                          Entropy (8bit):3.680951255407528
                                                                          Encrypted:false
                                                                          SSDEEP:48:kFvCAs6kKR6aQmF1cSNWrI+AjQndgV/Ap40FjDOP:khCAs6kC6aZF1cSN4I+AjQdgV/ApDFj4
                                                                          MD5:83C86E437B5FBA1DC9CC5235396AC381
                                                                          SHA1:5493A59C3A5A1B55ACD493E67F9E29D2A415A8DB
                                                                          SHA-256:9FA9D09509B4F8F5A9C8E422DBA02605070C3EBDAEB7C1DF8527C8EEF5E3632D
                                                                          SHA-512:86222489C65C87646939DECF91C2EC336EB46F64B644526A3FA8A4854B9D11819F6FD253107AB8A3DE911E254C88092D25137442164A6E437CDAF258A7CBB66C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Ulyanovsk) {.. {-9223372036854775808 11616 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 7200 0 +02}.. {695779200 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Uzhgorod

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7541
                                                                          Entropy (8bit):3.769633712898356
                                                                          Encrypted:false
                                                                          SSDEEP:96:dpSlo5Epkn/paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:dpUWnmivBeRF+W35Syrwl9h5j
                                                                          MD5:4AD237C8A1D94E2CB70377C49867AC76
                                                                          SHA1:121303331223925BFB708918BAED3CD2F0E33C60
                                                                          SHA-256:747F543B7A875214F8EEBFDAE3182D91B1E93CEB57B58D2B7657672F949B13A9
                                                                          SHA-512:FD2FB930CB81BD3427AEF374ACAC2A120F6AD447625824AD6D08E68868A3B389FDDE7E2A82FCFF3490488601ADE646AC989AA7CEF1FE77A700E232D7561B6E74
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Uzhgorod) {.. {-9223372036854775808 5352 0 LMT}.. {-2500939752 3600 0 CET}.. {-946774800 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796870800 7200 1 CEST}.. {-794714400 3600 0 CET}.. {-773456400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 3600 0 CET}.. {67

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Vaduz

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.953146873643623
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQa1NEHp8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/yvNEJ8G
                                                                          MD5:A0BAEC8B6AF1589ECBE52667DDB2A153
                                                                          SHA1:37093F4F885CBFA90A1F136D082E8B7546244ACC
                                                                          SHA-256:06B235BF047FC2303102BC3DC609A5754A6103321D28440B74EEC1C9E3D24642
                                                                          SHA-512:DBEC235AFB413FA8D116FA1AFFE73706762E7458038B6D68E0BFD71C339510D766825BA97055A06DEE14D5880EAE6CD035BFE0C935C0DF44B0107A356D293A78
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Vaduz) $TZData(:Europe/Zurich)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Vatican

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):176
                                                                          Entropy (8bit):4.914414313741477
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQa1xLM1p8QaxE:SlSWB9vsM3ymx5PHAIgoxvN/yvN+8rE
                                                                          MD5:2404265F8DE1F7D7745893DD4752BA1C
                                                                          SHA1:C07E7F72DBDC7F5F746385523EA733C2714F5DA2
                                                                          SHA-256:C203E94465BD1D91018FC7670437226EF9A4BB41D59DDE49095363865CA33D00
                                                                          SHA-512:5C20834542B74041AAB1DBE35686781B32EEB5814B1A35A942E87D1FC3B6D8F9264CB90433C44A480EA86DDEA65D8C152F41CE3E983C1DE5FA74D6FB5208F701
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/Vatican) $TZData(:Europe/Rome)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Vienna

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7930
                                                                          Entropy (8bit):3.8193566380830273
                                                                          Encrypted:false
                                                                          SSDEEP:96:8F6zq+gH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:8ozE41sFpM5vwA6Efv03TBZLl
                                                                          MD5:6A3A8055DD67174E853C7A208BABAC9B
                                                                          SHA1:64445543DE9D6C01FA858442976E249E37BE23EF
                                                                          SHA-256:A8165313C9B51DAEF130401439CBA60DAA9887FC5EAA61A5AFD4F7BAD1AD934F
                                                                          SHA-512:4407B9E8709A8DD05337A10030895AA9876EAF64EF5347952249EE2A541E304331B46D38532FD7CDFF9E633BF8C9884282F0A5ED259EBA1D99DC0914AF1A50C6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vienna) {.. {-9223372036854775808 3921 0 LMT}.. {-2422055121 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1577926800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555801200 3600 0 CET}.. {-938905200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780188400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {323823600 7200 1 CEST}.. {338940000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CE

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Vilnius

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7485
                                                                          Entropy (8bit):3.7711709848169592
                                                                          Encrypted:false
                                                                          SSDEEP:96:FAhEpkwCXkSV3A/PplKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:FfWHUSKivBeRF+W35Syrwl9h5j
                                                                          MD5:1AB5FCEACC4E09074BA9F72F0B7747D5
                                                                          SHA1:E0134E61EC0ADC60BF6DB4544EA7B7FFA4EC7857
                                                                          SHA-256:B762DB4A068DC79FA57691E070D7026086E5A6D2FC273D5C1872E7C8E3711533
                                                                          SHA-512:07565071D05CF972DD64F6060599EB68A00BF264172873BA310168AD07CE0CFCF90D0019B775433EC910DA748B89F0C614E7FD4E821993DA53C7E33F194C6A97
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vilnius) {.. {-9223372036854775808 6076 0 LMT}.. {-2840146876 5040 0 WMT}.. {-1672536240 5736 0 KMT}.. {-1585100136 3600 0 CET}.. {-1561251600 7200 0 EET}.. {-1553565600 3600 0 CET}.. {-928198800 10800 0 MSK}.. {-900126000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-802141200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 7200 0 EEMMTT}.. {606873600 10800 1 EEST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Volgograd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2123
                                                                          Entropy (8bit):3.667144931158014
                                                                          Encrypted:false
                                                                          SSDEEP:48:menvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDqR:mevCAs6kC6aZF1cSNcjXgV/ApDFjDqR
                                                                          MD5:53E5BA5747B3255BB049F6FF651CEE25
                                                                          SHA1:A69E2BFDB89AC8756E1CD2EAA9109ACD924A0850
                                                                          SHA-256:22968D40DAC2B669E6D2BC43ED6B16C8A9CA3E1F9DACBF8B246299C3C24CC397
                                                                          SHA-512:3269D20DF9C9DDFF8252F33ED563B118771FC71049542DA7C6678E0B5B75FFEA00845FA6F3BC26EDABB4BB7CE449B0B7E00B72473D8D95F126AB3893A9A969B4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Volgograd) {.. {-9223372036854775808 10660 0 LMT}.. {-1577761060 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-256881600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Warsaw

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8662
                                                                          Entropy (8bit):3.8187545871488995
                                                                          Encrypted:false
                                                                          SSDEEP:96:ELn9M9Nivtctwwoy4qelPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCso:E6Nivtctgq1sFpM5vwA6Efv03TBZLl
                                                                          MD5:992C1D268E336AF1FB8200966C111644
                                                                          SHA1:C893B82224C8EF282DB2E16A5BBCC3A21C49B6FE
                                                                          SHA-256:F9DC10EC2AE2CC810A6C08837059B34BE651900BA4E1CEDB93C209972CCFB5A2
                                                                          SHA-512:EC4E0D8684D57FA66144F11D8E8C80E5272D4A7304300FEBE20E236476C1B8B33BBC5E479BF96D9ED12900FE6D41DD1DC0D11CBE02B89E0C4C7A153B4BFBCB1F
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Warsaw) {.. {-9223372036854775808 5040 0 LMT}.. {-2840145840 5040 0 WMT}.. {-1717032240 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618696800 7200 0 EET}.. {-1600473600 10800 1 EEST}.. {-1587168000 7200 0 EET}.. {-931734000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796870800 7200 0 CEST}.. {-796608000 3600 0 CET}.. {-778726800 7200 1 CEST}.. {-762660000 3600 0 CET}.. {-748486800 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-715215600 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-397094400 7200 1 CEST}.. {-386812800 3600 0 CET}.. {-371088000 72

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Zagreb

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):187
                                                                          Entropy (8bit):4.899266605519742
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQa5rXv1/h8Q0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNB
                                                                          MD5:B07D9D3A5B0D11A578F77995A5FBE12B
                                                                          SHA1:1C4E186F2D53C0A1E6A82A6D33B172E403A41D6D
                                                                          SHA-256:A49B3894EB84F003EB357647D6A40CEAF6213523196CC1EC24EEFD7D9D6D3C3E
                                                                          SHA-512:43520AE325980B236C47C866620D1DA200AC0CD794E8EB642D2936D4B0ECEFE2DA0A93C9559D08581B3CCE2BC75251A4D5B967D376B16EB0C042B0ADCE1DCD01
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Zagreb) $TZData(:Europe/Belgrade)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Zaporozhye

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7490
                                                                          Entropy (8bit):3.767302554706298
                                                                          Encrypted:false
                                                                          SSDEEP:96:rnziEpkvV5lpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:rhWd50ivBeRF+W35Syrwl9h5j
                                                                          MD5:CC195C2ED7DEE40A4A42C6CCF64E4DB6
                                                                          SHA1:34DC86891FBAAAE0FF328D4896566C777CDF1075
                                                                          SHA-256:F0045F64F64A2C40088F2960616AB8E0AABB8D6309F489FEE842056FB8412F72
                                                                          SHA-512:8F58C8023260B5BBA51EE05811F33A2315A79996C900F04069372114EF3B1AB593CE7155288B8699BF2B2E9B284FE5109827B3FC8644012DB54D039E73F2B8EA
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Zaporozhye) {.. {-9223372036854775808 8440 0 LMT}.. {-2840149240 8400 0 +0220}.. {-1441160400 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-894769200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-826419600 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {638319600 14400 1 MSD}.. {654649200 10800 0 MSK}.. {670374000 10800 0 EEST}.. {686091600 7200 0 EET}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Europe\Zurich

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7305
                                                                          Entropy (8bit):3.8199799674700277
                                                                          Encrypted:false
                                                                          SSDEEP:96:94hH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:9Y41sFpM5vwA6Efv03TBZLl
                                                                          MD5:EBD66FAEA63E1B90122CC1EB21634ECE
                                                                          SHA1:C6487BB8AB2A6A72B2170B220F383ADB6B9AC91C
                                                                          SHA-256:95AFA61E439CA38551306D8FDB11C2788D935C42768D0407C9E4337F105A3E93
                                                                          SHA-512:25A8D0ED9BBE6BF23A1A76CC6D5378CF4D50544AA22DA97DDCD0673D7A5CCFEFFD81B660A1AEFB254B8BBEA55F6EF734BBBD3F0CB903E0721BE107667CA1E328
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Zurich) {.. {-9223372036854775808 2048 0 LMT}.. {-3675198848 1786 0 BMT}.. {-2385246586 3600 0 CET}.. {-904435200 7200 1 CEST}.. {-891129600 3600 0 CET}.. {-872985600 7200 1 CEST}.. {-859680000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\GB

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):170
                                                                          Entropy (8bit):4.8978035005721265
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/wox6QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/wRj
                                                                          MD5:68667037110E713DB3F51922DDE929FE
                                                                          SHA1:2EB02BE3FD35F105B59847892A78F1AA21754541
                                                                          SHA-256:E20D829C605A7C5B2A96B83C3480DF28C964A13381A8BD2C72C2A37295131FA7
                                                                          SHA-512:3A8CC2EC9E3053283F996CA2C4B422061D47F1D16CA07985CBA2C838DF322C23CC9DD28033646F22EAE0E401781480B9D3AF82A539444166A4DD9B7BCCAE45FE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:GB) $TZData(:Europe/London)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\GB-Eire

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):175
                                                                          Entropy (8bit):4.90874180513438
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/w4b/h8QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/w4E
                                                                          MD5:625520BAAB774520AC54BFB9EDCF9FCA
                                                                          SHA1:C72F0FD45F448901C6B2E24243175729591B9A54
                                                                          SHA-256:C9334480D0A970254B6BA6FF22E958DC8DD8BF06288229461A551C7C094C3F1D
                                                                          SHA-512:1B672218FF9C86168E065A98C3B5F67DAB710D1C2A319E9D6599B397C4B4C00D3721B76C735C8AB04BCB618C1832B07F6CCDAF4266CC0D12A461A3A862D1AEB2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:GB-Eire) $TZData(:Europe/London)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\GMT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):153
                                                                          Entropy (8bit):4.867609984313873
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wZ8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wZ8RQy
                                                                          MD5:A01FE6FC260711F0E11C85DC3DE3550A
                                                                          SHA1:988311B71498591425C63669DC3F802F270B2C44
                                                                          SHA-256:747C15CDC239855D5380B7A7F47112F2A26C61B0BF300EEB9711E6521550D189
                                                                          SHA-512:BE4678DCBAE5DBC72865665413206C1909F28BA54F4943257870EFFBA6525457866DED7A985E89F2689C810B314DE4AA2FA3A0A1826A664727F5F7113AA56595
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\GMT+0

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):155
                                                                          Entropy (8bit):4.917182390229381
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/we7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wI8RQy
                                                                          MD5:3327B1BF3118AC6AFC02C31DF5B67CD9
                                                                          SHA1:3932577E66801AD31519B0BB56CCE7B9E36221A9
                                                                          SHA-256:BE48462CCFBB3AEE19597F082A17C2C5D2FD8BB1C9122245EFAB0A51F8F413B0
                                                                          SHA-512:53866FD513B039E8203E51FF3434D5736D3A4C4E0A46874D1C99A17115181AF749F0D079C2E14C5B0538D3DFA52B1645C977CD6599DA3EDA57CC7F84EEAB2D06
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT+0) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\GMT-0

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):155
                                                                          Entropy (8bit):4.904279164422928
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/w4Hp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/w4J8RQy
                                                                          MD5:0CFFC5655F031D954BD623CC4C74DC9C
                                                                          SHA1:CE5E7AD67252F52D7E70719725FF5BE393DD6EF0
                                                                          SHA-256:944C86F516141DDC3AEC1AE4A963E9769879C48ED12DADDF4ED63A01313ACD00
                                                                          SHA-512:C7352D1394E8B8AC90CD19EE753D5277259BE5512ADDCAED2A2DEF144762CF20BE7A9FA09AAA1829EE401DD195C2AED8C967A7FF46739236E042AF4298EC84A2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT-0) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\GMT0

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):154
                                                                          Entropy (8bit):4.892526720357546
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wPHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wvp8RQy
                                                                          MD5:565B41A5DB28F9FE7D220E9BA39062A4
                                                                          SHA1:5183689210F07C8A71F880DCE8E5C2CB62CEB17D
                                                                          SHA-256:54850A5F488205DB01FBB46E2DA9FFF951C4571029EA64D35932DDEA5346DAAF
                                                                          SHA-512:BD6E5141F06B03D62DCF725E9E48D6AA8ECD6E8E47A4015B25DC3F672392065FFFD80D688C6695324DC105EA528025CF447FA77E6D17E15D438E61DC51879CB7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT0) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Greenwich

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):159
                                                                          Entropy (8bit):4.917976058206477
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wE+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/wE6BURQy
                                                                          MD5:443FA76F107ED438F9571A044B848C6A
                                                                          SHA1:1CF508429DFC40643B1FAB336A249A3A287D8C7C
                                                                          SHA-256:9E7A8DAA26CE36E8F7D7F13460915C063EE98E2A4DB276AD9D15CA5C7C06815F
                                                                          SHA-512:6C0C5FF513A742FBDA349AC3A2581D456701B5348A54ECF38E496DAA1EFC74D937982B6F69F1761CC2FC4B88D9A971EFA2B16096E71EAF002EC5CE4130B533DE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Greenwich) $TZData(:Etc/GMT)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\HST

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):111
                                                                          Entropy (8bit):4.90682088010982
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x//LhdNMXGm2OH1V90v:SlSWB9eg/jJDm2OH1VGv
                                                                          MD5:79C82A5F8B034E71D0582371E3218DBB
                                                                          SHA1:1476CE8EA223095094B6D25D171E6319C96669F4
                                                                          SHA-256:8D710699AF319E0DDB83E9F3A32D07AE8082EA2F7EABBD345EFFFFB0F563062E
                                                                          SHA-512:ADEE55581D1A158929F09A63B03883ABE9193337DDF225C61AFDBB8A2C7D0BD248ADC4714E0EEFD334826C54C1AFFC8B1E6C2B0D6EF830C3CCA50CC79834F473
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:HST) {.. {-9223372036854775808 -36000 0 HST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Hongkong

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):179
                                                                          Entropy (8bit):4.913328649996328
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8Li0vXHAIgN2qfvRL//XF1p4WFKQyvn:SlSWB9vsM3yW2HAIgAOvN///p4wKlvn
                                                                          MD5:6A307B229C302B1BAE783C8143809269
                                                                          SHA1:EA169AF81AD12380A69FB6B7A12479BA8B82878B
                                                                          SHA-256:359C9C02A9FA3DE10BA48FA0AB47D8D7AFF3B47F950CFAF5EB68F842EA52AB21
                                                                          SHA-512:505445FD0B3E140384EDC27993923BBF9ACD23A244B0F14D58804BFAA946D0BC4C0D301FBCCB492BAFDA42C8A92F4163FB96F4D75DD7374858D1C66183BEC24B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Hong_Kong)]} {.. LoadTimeZoneFile Asia/Hong_Kong..}..set TZData(:Hongkong) $TZData(:Asia/Hong_Kong)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Iceland

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.888934660651573
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqLGsA/8rtyXHAIgvMGsA/8rJARL/+GAKyx/2RQqGsAW:SlSWB9vsM3yj6SHAIgv1sAN/+XZx+RQK
                                                                          MD5:F51C5B80789F65136304CE107E4E60E1
                                                                          SHA1:3F4690BCCA45C0ADEC184175DEC53730C326733C
                                                                          SHA-256:E4AB3A08ED590D907F9741D4B8FE27E552B19FE0257F14CE2ED5289D5685974C
                                                                          SHA-512:9D0BB2D8C9D42C3F7274E0831B4320023069A7DF2069AA5EB6FF1BBBF5781629020BBB70C9ECCC38955FC79A5E2CB3110AB90C21191A6FB421F3195C31FC984C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Atlantic/Reykjavik)]} {.. LoadTimeZoneFile Atlantic/Reykjavik..}..set TZData(:Iceland) $TZData(:Atlantic/Reykjavik)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Antananarivo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.807410166086502
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6EL/liEi2eDcVVMB:SlSWB9vsM3y7VTHAIgNTxcAN/+LzM2eV
                                                                          MD5:0F20CBF1F7600D05F85D4D90FDAB2465
                                                                          SHA1:2F3C9479C4F4CD7999B19C07359B89A5FB1B9839
                                                                          SHA-256:1B1177CE4D59D7CBCAE9B0421EB00AD341ECB299BD15773D4ED077F0F2CE7B38
                                                                          SHA-512:657341FC2CCD6A4F7B405ABC8E24C651F6FFEFD68EBD6E2086ADF44834DCBF21D1B9D414436E42C8DCE46FFB88116B98C1D073782E214B3996D49EC00DFF4383
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Antananarivo) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Chagos

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.853088038233057
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL9WJx3vFNMXGm2OHi/FvoHscfJ7XH0VQVFV6VVFSTVV:SlSWB9eg/+LxWJxPDm2OHqFvoH9+VQV3
                                                                          MD5:06143C3DFD86B3FE4F2A3060C0E05BB6
                                                                          SHA1:88E0E30CEE4AB8117860A35AD03B16AF48988789
                                                                          SHA-256:11044AD7CB0848CC734D2A67128AA6AC07CB89268399AA0A71A99024DE4B8879
                                                                          SHA-512:79195D3D0D475BEA982F40683D4BA14AC33B3FA91311F513DCED955C9297C2B0F12D94CCA930FAE0FB7F95DB34CD4E74B5AF0233E792122646592B7EFF0F3163
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Chagos) {.. {-9223372036854775808 17380 0 LMT}.. {-1988167780 18000 0 +05}.. {820436400 21600 0 +06}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Christmas

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):154
                                                                          Entropy (8bit):4.957836950238227
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL9FBIEW3odNMXGm2OHAWMx5oHvTLyvMVSYovV:SlSWB9eg/+LxpW3SDm2OHAnx5oHvTIMI
                                                                          MD5:DA36A8158AF3480E67CD6EF3ABB875E3
                                                                          SHA1:9DA259BFB6B39AB0425E67A1E4F1ECAA1321AD72
                                                                          SHA-256:CB43DEAFAD0F8BF7DE8567841790A58D358EF2B210BB2022686B3EB7F97B2E5B
                                                                          SHA-512:48B20BFD14B0C756CD3AAA9A422837D7D5012612294EB01EBF12A26D0147D85087DED1B95C3E5CAB1485E8BC3B19A69B9DB234D06562AD0482CB7518977256BE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Christmas) {.. {-9223372036854775808 25372 0 LMT}.. {-2364102172 25200 0 +07}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Cocos

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):152
                                                                          Entropy (8bit):4.861380366254495
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL9dsFNMXGm2OHGXTvxoeoHvmVUXxXW5d6TW7Ay:SlSWB9eg/+Lx2Dm2OHGXCeoHv3BG5UI9
                                                                          MD5:4D5285269D6F0A54495B10EEF4994E01
                                                                          SHA1:FEE44907B02B660390CFDC560E3981112D5774BB
                                                                          SHA-256:71194B896CC00967EBBE3F9F4609F8C5CD73CE56B2529646A7A6AC679BB03400
                                                                          SHA-512:068D29EA51465A5232724A0CEF0274FD5DFC16A44720823CEA470125129FF527BF411EDAAFAEBE5F9783334BD93DB92372D0847207E4A42C79A0F6158163F1C8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Cocos) {.. {-9223372036854775808 23260 0 LMT}.. {-2209012060 23400 0 +0630}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Comoro

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.825881690094318
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6EL9TKlBx+DcVVMB:SlSWB9vsM3y7VTHAIgNTxcAN/+LxGV+V
                                                                          MD5:7EBDFA311C7852AFADF880395071DE48
                                                                          SHA1:F6EC21FDFB75EC1BE45B1C4170147CBA3E870E7B
                                                                          SHA-256:53FA58E32DC2E4ABB574B2F78011815EEB7F89F453CC63C6B6C1460ABBB4CA5C
                                                                          SHA-512:DFBCD4EA4AFFA1D1CAE7308168874527FD36B5CAE76153AADA9C5E5F628258AB26654A16C8A5F8906FC5918398FD880B15B6DD4E3EF6AD3BE63D4A2455701FA8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Comoro) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Kerguelen

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):149
                                                                          Entropy (8bit):4.871582172327986
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL12h2FNMXGm2OHvavFd9vM0VQVFv:SlSWB9eg/+L53XDm2OHEd1nVQVV
                                                                          MD5:5D07EBAAF83E8E473C23142CB09A05BF
                                                                          SHA1:34FD76789085EB6336193889D8FB5A8B3142383E
                                                                          SHA-256:C7AFDE6978D8CE5413730D370E2776E2ACC7D96570A6034EB504C0F42CA5D1E7
                                                                          SHA-512:FC5613EFC3B8EFA3553ECD3232383FF4CF5F4D777A1E46C4D212080711EA33F38A59449F828C6E33CB1F359249F254B4869AFD8F434FBD5213E657732D832777
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Kerguelen) {.. {-9223372036854775808 0 0 -00}.. {-631152000 18000 0 +05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Mahe

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):149
                                                                          Entropy (8bit):4.942285614866899
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/+L6ELzJM5FNMXGm2OHuVdF+YoHscfNmHIRNVsRYovV:SlSWB9eg/+L/YDm2OHWgYoH9YHkSN
                                                                          MD5:ECA9671460E65583ADF4892E40F2402E
                                                                          SHA1:6E5DE51DD1FB619E33254F5967647A77A5D7C496
                                                                          SHA-256:8E1D0F7268A5EE75E8A7C17FD6E1A9880BAD18A612346C29D70B462024D7371E
                                                                          SHA-512:CBD970D789943120B8DE5A166B97ABC7E221F7692DE26FC5523FB0D76C4BF9D10F541778ED1ABB7A3B9529547C20B804B702B7221516970B7B3225A87682AC93
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Mahe) {.. {-9223372036854775808 13308 0 LMT}.. {-1988163708 14400 0 +04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Maldives

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.883092265054605
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/+L6ELzE5FNMXGm2OHnz8eoHvZT5lxV/uUQwGN0VQVFv:SlSWB9eg/+L/EJDm2OHnz8eoHvZT5rdI
                                                                          MD5:4DF975C040D78FA8F9C92E5565D63A73
                                                                          SHA1:48488F076871530D32278084F1C9CB90CB1E6AB4
                                                                          SHA-256:9FAC69DC609CC6074ECD67E0BE8AE62E33D8D9C7F055A3E0DEE1430C7FFC54F6
                                                                          SHA-512:880B920FB51F48731BA8C741B9583038A3276221C55F1CE0B464D2797D71EF9D22B4E166841BAB0544B7091CE683697BFCA5A4235FF1E6264B0619DBDD4BB619
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Maldives) {.. {-9223372036854775808 17640 0 LMT}.. {-2840158440 17640 0 MMT}.. {-315636840 18000 0 +05}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Mauritius

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):272
                                                                          Entropy (8bit):4.5144164346164715
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/+L/GDm2OHlNnoH9SvulvSNFF+c0FSFFMVhvSNFFVBjvVFSFFVGlvSN:MB86+L/CmdHlNnCy6qB0FScZq9BjVFSL
                                                                          MD5:05362B6A17C5F4F4E8CBE5A676D5D0DE
                                                                          SHA1:84675D5E8D1425A5E9DB07D1BC1E6A5921B5AC91
                                                                          SHA-256:A2B1B93CBEECBD900ED71E61A4932509EB52688E97A6015DAD067066D0D42072
                                                                          SHA-512:351D2BC5F5888D8E842BF160D11D57E059811186D63B0413061768C7FE348CECB700748A0C0125F0ABCBB039FC74FF7BEEFDD42088BA1E28C785E545ED2CDF24
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Mauritius) {.. {-9223372036854775808 13800 0 LMT}.. {-1988164200 14400 0 +04}.. {403041600 18000 1 +04}.. {417034800 14400 0 +04}.. {1224972000 18000 1 +04}.. {1238274000 14400 0 +04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Mayotte

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.828945679595274
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6ELzO1h4DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/+L/O1hm
                                                                          MD5:8ABBEC0E138C1A68CB5D096E822DE75E
                                                                          SHA1:E9C5CE1A249F6DC0F6EDBB3F5B00F3106E3BD6CA
                                                                          SHA-256:845C45FD7B6F0604B03A3C72DB117878B568FB537BCA078304727964157B96AB
                                                                          SHA-512:15790CCA70140D3139F3E2A202DC8F12E68466A367C68458D6A78CDDC7822FB5EDB87D630926B51F3DE48D95DE7CA3FCB946CD7B762FE5B15866DAA9DBA40B46
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Mayotte) $TZData(:Africa/Nairobi)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Indian\Reunion

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):152
                                                                          Entropy (8bit):4.978742383555601
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/+L6ELsAcCFNMXGm2OHuU7oeoHsdvcUeNVsRYovV:SlSWB9eg/+LBXDm2OHb7oeoHTfNSN
                                                                          MD5:A03BEEC3F4CF0F6E1077A04C67CF3375
                                                                          SHA1:4C39038341E26C2E68F2E46AD243A0955098F149
                                                                          SHA-256:E039B16CAAB8F5D8F85625E0CC1D0FE42369715F2A4810BDF7F9CF19A28B5603
                                                                          SHA-512:B23C6C28FEE0A8CA93DB2928A9AC97DD8475B7C1FC6DCB70E696F066D67DF4FF0285D7631400DEDD780C4B5F868B194CC59108FCFA519473D1ADDEC36CC53262
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Reunion) {.. {-9223372036854775808 13312 0 LMT}.. {-1848886912 14400 0 +04}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Iran

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):166
                                                                          Entropy (8bit):4.809541513808179
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8g5YFeovXHAIgNqjyVHRL/+XiMr4WFKBpv:SlSWB9vsM3yA5oPHAIgcjeHN/+Xvr4wY
                                                                          MD5:A90C26358FEF60E49044E3BE02866FAC
                                                                          SHA1:137AC8CCA23F39E7A16C4050EA9A3A8731E9AAD7
                                                                          SHA-256:FE7F4453CB5F6B81B23C1C795356B91FE319F0762BE7868FAFE361DB1F9C2A2B
                                                                          SHA-512:D6C74CACF69D29E14CB46E5DD885234AC50EE2E258E0C5E3AC76465061622F064F974D33E91A6A020B9D618D90799DDA6EB1EA53022EDB6E26A9CB6ADFE0AA30
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Tehran)]} {.. LoadTimeZoneFile Asia/Tehran..}..set TZData(:Iran) $TZData(:Asia/Tehran)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Israel

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):177
                                                                          Entropy (8bit):4.8290104377288925
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/+WXnMr4WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/+zr4wKY+
                                                                          MD5:6BCC43951637D86ED54585BE0819E39C
                                                                          SHA1:6F04F306B3AB2A6419377294238B3164F86EF4A3
                                                                          SHA-256:805105F5F17B78929F8476BAE83ED972128633FF6F74B7748B063E3C810C27A6
                                                                          SHA-512:ABB9F4308BF4BD5C62C215A7ECD95042CBFB3005AF1E75F640962B022574C930DD5A12CD0CE0AF8A3D7E38B999E37C3A45A55091683F6A87E9D0CDA9EE417293
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Israel) $TZData(:Asia/Jerusalem)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Jamaica

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):181
                                                                          Entropy (8bit):4.722012123002917
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx00EIECWXHAIg200EIE/vHRL/9S//2IAcGE0EIESvn:SlSWB9vsM3y795VHAIgp95HN/029095c
                                                                          MD5:1F020341AD51AA82794B8018F214DE0D
                                                                          SHA1:4414E56C1277B4D31FE557F8652D522C0594F4B2
                                                                          SHA-256:F01B00D52BD7B2694BF5CB55A17028C30A41BD22A774CA54740E8B1DDE4FCB2E
                                                                          SHA-512:CC41848A851D4992AE9F27C38669CB87CE2FD05A33AB6989EA21AFCB1A2707DE0CB4D62BCC45E536DD944859991D7564847205F47509A42D41932370496A77D7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Jamaica)]} {.. LoadTimeZoneFile America/Jamaica..}..set TZData(:Jamaica) $TZData(:America/Jamaica)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Japan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):164
                                                                          Entropy (8bit):4.8422204749795545
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8aofXHAIgNqsRL/9hM7/4WFK9vn:SlSWB9vsM3ypPHAIgcsN/4r4wKNn
                                                                          MD5:9554A65BFFCFFCFB2C1588569BB4638E
                                                                          SHA1:B377ECB04586396D37093856AEF8BBDC93192F66
                                                                          SHA-256:98DBD07AE3B9251B9091F4D265336CE98BDFB492AF863C1F3FF25248A2CADF35
                                                                          SHA-512:E2E761B8B1995B68721BC714A546E0F45EEC025FAF81DE579FF0D73D37783D0E031B9E78BA2FAC6B097E3673C47AFB8761FBC58E42E33018FD44B77F2871E0C6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Tokyo)]} {.. LoadTimeZoneFile Asia/Tokyo..}..set TZData(:Japan) $TZData(:Asia/Tokyo)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Kwajalein

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.810216093939366
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG1/EOM23vXHAIgObT1/EOMH6RL/8/FMKpUDH1/Ex:SlSWB9vsM3yc1EiPHAIgOb1E+N/8xMEx
                                                                          MD5:05C0C40F2AA456F580EAAFC4F7E49B56
                                                                          SHA1:5796A9122693B2D6010BC5E617A6091F46330B0C
                                                                          SHA-256:85E95363ACF468043CD5146927A97B2D9E3B141EDA0A7993DADA9382D1D6DD54
                                                                          SHA-512:2155F8E3EB73312F0AFD5CDDF4B19EBB67A15658101870C2CEDF96955470DBC7B30F34E143D9C14CBFA7A138F63324009581BD0B807AE295C68588CA0470D7AD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Kwajalein)]} {.. LoadTimeZoneFile Pacific/Kwajalein..}..set TZData(:Kwajalein) $TZData(:Pacific/Kwajalein)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Libya

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):176
                                                                          Entropy (8bit):4.829980800076139
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsbKJqYkyXHAIgNGEnKJp0ARL/7beDcbKJ6v:SlSWB9vsM3y7JSHAIgNTxAN/PeDE
                                                                          MD5:4D44D88336212E162CCEFADE6321EDBC
                                                                          SHA1:B9EE7AFE26DC61AA9EA37EB99A3C10DD176E8063
                                                                          SHA-256:F776839C1999056E6A0D2ECFDF9054FC309454AFDFF8E8BC803F33EC423B7361
                                                                          SHA-512:FDDCBD194DE07B51DEBBDEF4FD96762EE3507117443FB9F7975FB56E0AE97B0D1F8657FE26B092021FB12B5A5D3EFFAB9E0A54B1C2AFCEC1029855442A0A95AB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Tripoli)]} {.. LoadTimeZoneFile Africa/Tripoli..}..set TZData(:Libya) $TZData(:Africa/Tripoli)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\MET

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7736
                                                                          Entropy (8bit):3.799706947156251
                                                                          Encrypted:false
                                                                          SSDEEP:96:aJCP8D3pCS2JWk55EyqJNSPTub3NDOyFyJYVtLbTxdqs0xcQVq+O7JSAmwQZjltB:FSyWBSPTujlOyqc3JuzVNvTN
                                                                          MD5:02B993B4A6956014A2DB844E8A5498C0
                                                                          SHA1:378333547254AC43BEB4FA2CBC24B8DE241B3078
                                                                          SHA-256:DF45F5414F1636B1856C7534BB5F3D4387C32D56283A68BB47D8C48C1DDAD5BC
                                                                          SHA-512:CC3ABCC1FB5ABD10A685F140931DE38D6875142D3595F8D9A581F5B31A7F354FA4CCC9727B69F58E0D2F773EA0F76D9ACFDF7ACBAFC6BAA6E93A46EAE8F18672
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MET) {.. {-9223372036854775808 3600 0 MET}.. {-1693706400 7200 1 MEST}.. {-1680483600 3600 0 MET}.. {-1663455600 7200 1 MEST}.. {-1650150000 3600 0 MET}.. {-1632006000 7200 1 MEST}.. {-1618700400 3600 0 MET}.. {-938905200 7200 1 MEST}.. {-857257200 3600 0 MET}.. {-844556400 7200 1 MEST}.. {-828226800 3600 0 MET}.. {-812502000 7200 1 MEST}.. {-796777200 3600 0 MET}.. {-781052400 7200 1 MEST}.. {-766623600 3600 0 MET}.. {228877200 7200 1 MEST}.. {243997200 3600 0 MET}.. {260326800 7200 1 MEST}.. {276051600 3600 0 MET}.. {291776400 7200 1 MEST}.. {307501200 3600 0 MET}.. {323830800 7200 1 MEST}.. {338950800 3600 0 MET}.. {354675600 7200 1 MEST}.. {370400400 3600 0 MET}.. {386125200 7200 1 MEST}.. {401850000 3600 0 MET}.. {417574800 7200 1 MEST}.. {433299600 3600 0 MET}.. {449024400 7200 1 MEST}.. {465354000 3600 0 MET}.. {481078800 7200

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\MST

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):111
                                                                          Entropy (8bit):4.902637155364683
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/6xtNMXGm2OHrXV4foAov:SlSWB9eg/6lDm2OHrCAAov
                                                                          MD5:36119516E87814F3C219193069CD6A90
                                                                          SHA1:BDB25531B30E6FC454100F37177EC9D4A0FB4E39
                                                                          SHA-256:E57746D5DB479A8B30973F2BC16E2B8DFB6E2BFAECBFF0FB956F04526E4B935B
                                                                          SHA-512:2730C5DABA0B2CCFD32A799C48EE07351659F51B9C2B91DCD145675AF276F2D0B5AA51ACF7D283C0DC236D3AFA3A75E58EB9F970B1831A6E36F02139CAF6A655
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MST) {.. {-9223372036854775808 -25200 0 MST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\MST7MDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8505
                                                                          Entropy (8bit):3.8405400251137207
                                                                          Encrypted:false
                                                                          SSDEEP:96:T1ktwmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:TswDPlLv/PCenJzS6cy
                                                                          MD5:87B3BCD4A793BA383889ECFDB44C846E
                                                                          SHA1:3EA34B5E6E3078A9501653BA069D5E5E879D7FE4
                                                                          SHA-256:A5DEB89D59613D9A54C1E146056A805B3DE9F2A2593AEC2B8A25F863328699C0
                                                                          SHA-512:AA4DAC2614661EF18A2A60A5BD4D5BBBCCB5D721F90A25E9D11C5B6AF8C39FD475B3E23894719E2F8F74469F13D5492FF31DDD193D9E3172182FBCBCDD860A41
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MST7MDT) {.. {-9223372036854775808 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1 MDT}.. {247046400 -25200 0 MST}.. {262774800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Mexico\BajaNorte

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.884776849010803
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qfSfXHAIg20qfORL/6AdMSKBbh4IAcGEqfBn:SlSWB9vsM3y7ekHAIgpeON/68K5h490m
                                                                          MD5:3050A0100A2313C1D3AB4278B464F17A
                                                                          SHA1:1A140447B3972900F13768659FD6979F68126E97
                                                                          SHA-256:F8CA38A845CD01BF785EE222277DAD9325AB6BD17E44A362C450855AEB522814
                                                                          SHA-512:C91C4BF2318C50D473E6051855C12F0E11CBAA8580B88115CDDE054D36476A1D8DDC5D17A7A123BD84148C20B96BD839511EAD573F5FD2C9A8556646B9CDE5E5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:Mexico/BajaNorte) $TZData(:America/Tijuana)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Mexico\BajaSur

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):191
                                                                          Entropy (8bit):4.8897674180962145
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0zjRJ+ovXHAIg20zjRJ8yHRL/6AdMPCoQIAcGEzjy:SlSWB9vsM3y7zjRJvHAIgpzjRJ8yHN/Z
                                                                          MD5:FAFD9727A0E153AFCB726690D215DA76
                                                                          SHA1:3CD3B2737FC781F38DE26E255968CBB88B773CBF
                                                                          SHA-256:2E6E32A40487F0146B59150B66FF74901CA853B12D47922819AF23EEA5B4149C
                                                                          SHA-512:76D110494D4EB76961C818B2A2CCB2303B31DA161664FA712C87B95B81DE7B8F3E50DC7B2836C6ECC6437AE9595668E62E4E706F1B343EFEA12C32210F113540
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Mazatlan)]} {.. LoadTimeZoneFile America/Mazatlan..}..set TZData(:Mexico/BajaSur) $TZData(:America/Mazatlan)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Mexico\General

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):200
                                                                          Entropy (8bit):4.877941255622543
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y7zBDSHAIgpzBx6N/6BXl490zBf:MByMYzppzH6t6Bi90z1
                                                                          MD5:29ACBFCD0FD521EC0C9523906B9E2252
                                                                          SHA1:BBC1AD3F78CAA634A2F0BC38059975EF8E4A2CE9
                                                                          SHA-256:2DFF1B83FECFAD5C27EC47B206696C29B91398F8185B5D406A66FA9E0AECA93F
                                                                          SHA-512:802502010CFB6F1F4E60C22ECB0E6CA22750975E5838BE7E7DC9D12EA019CB6508F0F87465A113A98356CC9E145E32E6633AE2B45B93412A358C4AD13E923EFE
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Mexico_City)]} {.. LoadTimeZoneFile America/Mexico_City..}..set TZData(:Mexico/General) $TZData(:America/Mexico_City)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\NZ

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):179
                                                                          Entropy (8bit):4.888611285267583
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG/u4WXHAIgObT/KvRRL/5E1nUDH/uov:SlSWB9vsM3ycqXHAIgObOvRN/iy
                                                                          MD5:92548E239012515D756E002768CA876A
                                                                          SHA1:6BDC73DBD7356C3F82C5C76E6E2D58656FA9E21D
                                                                          SHA-256:E22D629D53C54960AD156C377DE0AE461C27F554990A3D1305724CA8F869BCE4
                                                                          SHA-512:42AD074EE08E083EE91270F203707698A8B3308005C94514B8B2D950F4C6F0B37D7D32973EC9F6AB49A0875209076FB40341B31433A27E47B3CC0EA711ECE321
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:NZ) $TZData(:Pacific/Auckland)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\NZ-CHAT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):181
                                                                          Entropy (8bit):4.881663364410736
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG9WQ+DyXHAIgObT9WQiovRL/5AmtBFB/pUDH9WQg:SlSWB9vsM3ycwQ+DSHAIgObwQTN/zzJ7
                                                                          MD5:3811C133C6311E33FDAF93660E1EAED5
                                                                          SHA1:64756FF877B2EB91BAED2889B3924DAB6784DF43
                                                                          SHA-256:83F4CA3522B64F9B151EDEFAE53E0F28C2E6C4CE16D0982186B3344F2A268724
                                                                          SHA-512:7724D6CD08E13E116CCDF073F86CE317C0D4A849C5FE81DF3127D435704507FBF554BFC6E7A50CCA3852F6001D8654B7FF90466878DB8C3298338BE16149FD32
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chatham)]} {.. LoadTimeZoneFile Pacific/Chatham..}..set TZData(:NZ-CHAT) $TZData(:Pacific/Chatham)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Navajo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):177
                                                                          Entropy (8bit):4.8545620422964015
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/5vf1+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/pd+90+B
                                                                          MD5:5E9F3294F68873BF503F3DDDDF6713B0
                                                                          SHA1:954CD6F123C043E64F5E49733327E2C78877BDFB
                                                                          SHA-256:2CC8CE235F2EE3160E6AFD04A4E28AA0312494EBB6FED08D8CC81D414EC540EE
                                                                          SHA-512:200FC489989CA57219D5B28FB135BE5BDAC67239F3D243C496545D86D68089E51856CEAC4D2E700C0E47BAE4D5FEAB18A367C554235615B2B860F4E5E1BB08C3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:Navajo) $TZData(:America/Denver)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\PRC

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):171
                                                                          Entropy (8bit):4.902914099699953
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/nL75h4WFKdy:SlSWB9vsM3yMPHAIgO8AN/H5h4wKU
                                                                          MD5:87C439DC623BF5C7EB01ADA6E67FB63A
                                                                          SHA1:1CC357558E09CDEA49F821826D2AEA9A6EF2C824
                                                                          SHA-256:6A5BAA9CA54B2A2C6D21287443BE0B1064AA79B5C4C62939933F8A0AD842B73E
                                                                          SHA-512:E628B8F1C967AABAEFBB68A33416F6FE47422970BA18414BB3396AC063E65A4DC892595D4071395194AF320633EE915A494E1F8D4216EE8194A034739D275C49
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:PRC) $TZData(:Asia/Shanghai)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\PST8PDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8505
                                                                          Entropy (8bit):3.836877329152454
                                                                          Encrypted:false
                                                                          SSDEEP:96:0KhTG0hjvZkR/bvtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:0sG0U9bFzN6IkWq/WHQt/RY4yP
                                                                          MD5:45E7E9E183A990F56E17C04FA48CE620
                                                                          SHA1:A1F39E0ECEA3C64E761A9A3159E331FA51B625F9
                                                                          SHA-256:D148708F1E70EEFA51E88E5823776CBE710535D4D6D6356E7753A44463A1C5AB
                                                                          SHA-512:1D1F4BA90D07D7EE12DFD0E37DBFD5410A4EAFFBA8960B816FDD5963CD6B20938080A4248E7B249AAE02F068E817AB9A85735D226F7DA8DD2C5462A70B18E8EF
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:PST8PDT) {.. {-9223372036854775808 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-84376800 -25200 1 PDT}.. {-68655600 -28800 0 PST}.. {-52927200 -25200 1 PDT}.. {-37206000 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Apia

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):909
                                                                          Entropy (8bit):4.042826306713664
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86HbmdH2oVCvcCfdf3NaDyTb6Dye78ubUt1NEUtszIVbUtoUtoUt3mbUt4qUt6:Yekv5fcfem+Cuy
                                                                          MD5:E5B913965F72AB807BAE67BD20C0A699
                                                                          SHA1:2161B73EC868C8D18C09970766D19A8583FF7981
                                                                          SHA-256:983884249ACC11C3FE740D78E72B1A89BE9C8B077283549BF6BCD8C93FA71731
                                                                          SHA-512:F8807C52DB852C48C62F25569C990C31D977BC7D0DF502CF2B92F9ED6BCB89A6DD8A6758FBD1185E0B5C34DE5450D5C748B71760AC93E72DC3976B3B31D1A605
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Apia) {.. {-9223372036854775808 45184 0 LMT}.. {-2445424384 -41216 0 LMT}.. {-1861878784 -41400 0 -1130}.. {-631110600 -39600 0 -11}.. {1285498800 -36000 1 -11}.. {1301752800 -39600 0 -11}.. {1316872800 -36000 1 -11}.. {1325239200 50400 0 +13}.. {1333202400 46800 0 +13}.. {1348927200 50400 1 +13}.. {1365256800 46800 0 +13}.. {1380376800 50400 1 +13}.. {1396706400 46800 0 +13}.. {1411826400 50400 1 +13}.. {1428156000 46800 0 +13}.. {1443276000 50400 1 +13}.. {1459605600 46800 0 +13}.. {1474725600 50400 1 +13}.. {1491055200 46800 0 +13}.. {1506175200 50400 1 +13}.. {1522504800 46800 0 +13}.. {1538229600 50400 1 +13}.. {1554559200 46800 0 +13}.. {1569679200 50400 1 +13}.. {1586008800 46800 0 +13}.. {1601128800 50400 1 +13}.. {1617458400 46800 0 +13}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Auckland

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8772
                                                                          Entropy (8bit):3.900078030355782
                                                                          Encrypted:false
                                                                          SSDEEP:96:pj4hKuZaqaaiFKgjGeGV3atL67G9kJGsU+mpe7Vy:Cla1KgjGeGcQMsa
                                                                          MD5:8174D7205622711F58E0B515246FE89D
                                                                          SHA1:9777B2633ACF5588268D5072F817E65C879358AC
                                                                          SHA-256:201CFADB00FBCD3283249DAD73872ED75C5BEC07F5A5B157726638C20728B833
                                                                          SHA-512:64121ED1EE70D5423710319E806B19261576AECC89A64CBEC44A29BF4AC9FEE21C6484CC3C4550CC92C315B3855BE265F696F8CD4D95027226D608B3ADD022F1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Auckland) {.. {-9223372036854775808 41944 0 LMT}.. {-3192435544 41400 0 NZMT}.. {-1330335000 45000 1 NZST}.. {-1320057000 41400 0 NZMT}.. {-1300699800 43200 1 NZST}.. {-1287396000 41400 0 NZMT}.. {-1269250200 43200 1 NZST}.. {-1255946400 41400 0 NZMT}.. {-1237800600 43200 1 NZST}.. {-1224496800 41400 0 NZMT}.. {-1206351000 43200 1 NZST}.. {-1192442400 41400 0 NZMT}.. {-1174901400 43200 1 NZST}.. {-1160992800 41400 0 NZMT}.. {-1143451800 43200 1 NZST}.. {-1125914400 41400 0 NZMT}.. {-1112607000 43200 1 NZST}.. {-1094464800 41400 0 NZMT}.. {-1081157400 43200 1 NZST}.. {-1063015200 41400 0 NZMT}.. {-1049707800 43200 1 NZST}.. {-1031565600 41400 0 NZMT}.. {-1018258200 43200 1 NZST}.. {-1000116000 41400 0 NZMT}.. {-986808600 43200 1 NZST}.. {-968061600 41400 0 NZMT}.. {-955359000 43200 1 NZST}.. {-936612000 41400 0 NZMT}.. {-923304600 4320

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Bougainville

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):280
                                                                          Entropy (8bit):4.715653436088026
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/FtTfDm2OHHhp5oHvZiuo2HvDVeEU8vScH9syZEizy:MB86FtTLmdHf5CvZiIvJeJ8HH9F6izy
                                                                          MD5:4E858B3754BD8864719A61839ACA64E6
                                                                          SHA1:597025A8DAFD5AE75EBD162AC0E9DA71815816BA
                                                                          SHA-256:2D3BFDED297214BA25CFD8C6F508D0C8B1A1CD7D46701A78EC5E510076185EB6
                                                                          SHA-512:720F301B73C852EA8EEFA79DEF6B6762554E50222DE114FE87EB5178507F1895A9A39B3872A1A4B9DFF58D1CC6460BA4A82F2C165E3659E13036451F22E389C3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Bougainville) {.. {-9223372036854775808 37336 0 LMT}.. {-2840178136 35312 0 PMMT}.. {-2366790512 36000 0 +10}.. {-868010400 32400 0 +09}.. {-768906000 36000 0 +10}.. {1419696000 39600 0 +11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Chatham

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8165
                                                                          Entropy (8bit):3.6566720439018874
                                                                          Encrypted:false
                                                                          SSDEEP:96:gpvlGCcn6AadFurBrioCdL49mq9X4a2t3I/KVE:gOCBdFurBr0soaz
                                                                          MD5:8105A806A1762932897AB59C47BBE89E
                                                                          SHA1:386E41A4A83FA84DBFCA994F679242D067CEED64
                                                                          SHA-256:CA0EEF84DBC5964EF2265E9252237BE58BB8D75C34817CC2305CCCFAEC7E690C
                                                                          SHA-512:8A609E7F4868BD455DA811E62142FECD792D0CA0DAAF7C10C4E4254C9EC44B8EB92D388D9224C8FD3CC3FB326A106D831B80F5E1264CCF3EABBCE177BB82E9D6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Chatham) {.. {-9223372036854775808 44028 0 LMT}.. {-3192437628 44100 0 +1215}.. {-757426500 45900 0 +1245}.. {152632800 49500 1 +1245}.. {162309600 45900 0 +1245}.. {183477600 49500 1 +1245}.. {194968800 45900 0 +1245}.. {215532000 49500 1 +1245}.. {226418400 45900 0 +1245}.. {246981600 49500 1 +1245}.. {257868000 45900 0 +1245}.. {278431200 49500 1 +1245}.. {289317600 45900 0 +1245}.. {309880800 49500 1 +1245}.. {320767200 45900 0 +1245}.. {341330400 49500 1 +1245}.. {352216800 45900 0 +1245}.. {372780000 49500 1 +1245}.. {384271200 45900 0 +1245}.. {404834400 49500 1 +1245}.. {415720800 45900 0 +1245}.. {436284000 49500 1 +1245}.. {447170400 45900 0 +1245}.. {467733600 49500 1 +1245}.. {478620000 45900 0 +1245}.. {499183200 49500 1 +1245}.. {510069600 45900 0 +1245}.. {530632800 49500 1 +1245}.. {541519200 45900 0 +1245}.. {56208

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Chuuk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):305
                                                                          Entropy (8bit):4.600179085934857
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/ZzSDm2OH9pvoHT1YoHvmdcXALEzvScHoVvXKnOjvScHb01Fy:MB86RGmdH9pvCT1YCvnXALEzHHIfKOjd
                                                                          MD5:AEC058BE796F1513F3DF3E545290D223
                                                                          SHA1:27D274974AC95B724A4BFDD65CB1B9DD92F73E3D
                                                                          SHA-256:492DF366BB0A7D29D2DB4A9C40CF0C15CB47343FF908D1AA86092C8E84E4434B
                                                                          SHA-512:E0924AB86E512AE1B800DEFA637F6B1743FF77F1FEFDC5068A7C30C1AC0BAC60F0D0351278866FD98A59D56BA2C56A1AFC1EBB4F14AAFE5D450085587B7C8F4A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Chuuk) {.. {-9223372036854775808 -49972 0 LMT}.. {-3944628428 36428 0 LMT}.. {-2177489228 36000 0 +10}.. {-1743674400 32400 0 +09}.. {-1606813200 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 36000 0 +10}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Easter

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8203
                                                                          Entropy (8bit):3.546693824302767
                                                                          Encrypted:false
                                                                          SSDEEP:96:QXn3AWkHkPp2YXaVU+PO/Un4n6MSmSmiTpk9eL6Z5waKkhWILTc:QXn3AWJB2m+PO/UnOSmSmS6ZaILg
                                                                          MD5:B8B2048F107528DEB4B04CB3E698A5BD
                                                                          SHA1:0E82DCB11A4553771760B8B0A748EC03F953D2FB
                                                                          SHA-256:84B815988D1A5AC16F3EC52844BDCE7A8E8707800C782235B5928473EEF9B433
                                                                          SHA-512:511E3C51B4016641146D21264C031151F2CE9F916F0D97C47D623B66F6244BA9243108179C786B63B8B71F77885B916AC6D18C10CFA1001290019CE6B73278D9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Easter) {.. {-9223372036854775808 -26248 0 LMT}.. {-2524495352 -26248 0 EMT}.. {-1178124152 -25200 0 -07}.. {-36619200 -21600 1 -07}.. {-23922000 -25200 0 -07}.. {-3355200 -21600 1 -07}.. {7527600 -25200 0 -07}.. {24465600 -21600 1 -07}.. {37767600 -25200 0 -07}.. {55915200 -21600 1 -07}.. {69217200 -25200 0 -07}.. {87969600 -21600 1 -07}.. {100666800 -25200 0 -07}.. {118209600 -21600 1 -07}.. {132116400 -25200 0 -07}.. {150868800 -21600 1 -07}.. {163566000 -25200 0 -07}.. {182318400 -21600 1 -07}.. {195620400 -25200 0 -07}.. {213768000 -21600 1 -07}.. {227070000 -25200 0 -07}.. {245217600 -21600 1 -07}.. {258519600 -25200 0 -07}.. {277272000 -21600 1 -07}.. {289969200 -25200 0 -07}.. {308721600 -21600 1 -07}.. {321418800 -25200 0 -07}.. {340171200 -21600 1 -07}.. {353473200 -25200 0 -07}.. {371620800 -21600 1 -07}.. {384922800

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Efate

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):789
                                                                          Entropy (8bit):4.0457106900970325
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86HmdH6mvCON3Xj/kw2eX/xtDedjX24ots0FX2ud5KRGkpFxy:uegazZBzCdXUFQzy
                                                                          MD5:6841B8A2FB9BBF464AA00088CBDCEC80
                                                                          SHA1:26CC5CCE00A765F8B6493ED24F50957AA7F0089B
                                                                          SHA-256:332372E5EFB46123FBB66F9F32F91B59EBD88ADB956249DB3F14CAAB01CE2655
                                                                          SHA-512:A6C67A0F7361E599369597E9A8A52FC7D5C96DE6B5A7C1BE1D02F5DF11051F448289786C7F0E82E71CDEB825215E64E072CF034C45D6E2F822D7201AB8B41B57
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Efate) {.. {-9223372036854775808 40396 0 LMT}.. {-1829387596 39600 0 +11}.. {125409600 43200 1 +11}.. {133876800 39600 0 +11}.. {433256400 43200 1 +11}.. {448977600 39600 0 +11}.. {464706000 43200 1 +11}.. {480427200 39600 0 +11}.. {496760400 43200 1 +11}.. {511876800 39600 0 +11}.. {528210000 43200 1 +11}.. {543931200 39600 0 +11}.. {559659600 43200 1 +11}.. {575380800 39600 0 +11}.. {591109200 43200 1 +11}.. {606830400 39600 0 +11}.. {622558800 43200 1 +11}.. {638280000 39600 0 +11}.. {654008400 43200 1 +11}.. {669729600 39600 0 +11}.. {686062800 43200 1 +11}.. {696340800 39600 0 +11}.. {719931600 43200 1 +11}.. {727790400 39600 0 +11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Enderbury

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.82787610497142
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG11avXHAIgObT11ORL/nUDH7/UDH11B:SlSWB9vsM3yckHAIgObON/h
                                                                          MD5:CD1AC50AADC3CF9C0E7A055D587E790D
                                                                          SHA1:BEE0E16D3954DF33C697DEA469A130BD9875AB8B
                                                                          SHA-256:790E6B48B261D6DEF7D183CC8F38FB8D8A6E3EFB8844281EFABB2DFD621E53B5
                                                                          SHA-512:B6A93DFB4CBE2F35268AACA88FDCC4D19949A2E8DC9464D8341C38065C6FF48A3C49FE756FFCE777C8F806DE309C8AFC4CE4BC4ABD183C28808F995A0F89B091
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Kanton)]} {.. LoadTimeZoneFile Pacific/Kanton..}..set TZData(:Pacific/Enderbury) $TZData(:Pacific/Kanton)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Fakaofo

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.913439535905759
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDH4ErKYofMXGm2OH18VkeoHvmUENBBy/aCPFVFv7Dy:SlSWB9eg/BE3ofDm2OH1VeoHvmH7y/Fy
                                                                          MD5:6250F332356787613A2D1853EF6D1AC3
                                                                          SHA1:0464B9EE8B691990022295D2DEFE1AAE4B247E63
                                                                          SHA-256:336058DCA4802C79ED43F6177ADB73085D4FA0754B94051CAE2A19346B0C4904
                                                                          SHA-512:B8FAB5E128D2EF3CB7050DA717D80247045BE09F7F6542AA154CB85F4A56884F195EE2776421890A3F86D133106DCA4672D7D9329E0DE6F4A7CF8F4030822988
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Fakaofo) {.. {-9223372036854775808 -41096 0 LMT}.. {-2177411704 -39600 0 -11}.. {1325242800 46800 0 +13}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Fiji

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5636
                                                                          Entropy (8bit):3.637086785452708
                                                                          Encrypted:false
                                                                          SSDEEP:96:9QdCQvGPccyGqjXKZ2luR7oVqqJZozv88s2:Wd9vGPfyGi6Z2opCs
                                                                          MD5:D2A17937A99B50B3BCD50F8C10520B56
                                                                          SHA1:A27681C6EC2B4625262359E5ADFEA09CAB58FAFC
                                                                          SHA-256:A29FAAEE67BC07F5DF858DAC070F03E45E29B67A5F9DE6DD992E79A9601979B7
                                                                          SHA-512:A16F96B17E7221A9C60EF506D7ABFE806304AAAB8C64A69E340E9960BEB64C7334931CD6FBBA5F22A1A3BFFE55690BDF04E60852E516CB3048EE34AC3EAB16CC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Fiji) {.. {-9223372036854775808 42944 0 LMT}.. {-1709985344 43200 0 +12}.. {909842400 46800 1 +12}.. {920124000 43200 0 +12}.. {941896800 46800 1 +12}.. {951573600 43200 0 +12}.. {1259416800 46800 1 +12}.. {1269698400 43200 0 +12}.. {1287842400 46800 1 +12}.. {1299333600 43200 0 +12}.. {1319292000 46800 1 +12}.. {1327154400 43200 0 +12}.. {1350741600 46800 1 +12}.. {1358604000 43200 0 +12}.. {1382796000 46800 1 +12}.. {1390050000 43200 0 +12}.. {1414850400 46800 1 +12}.. {1421503200 43200 0 +12}.. {1446300000 46800 1 +12}.. {1452952800 43200 0 +12}.. {1478354400 46800 1 +12}.. {1484402400 43200 0 +12}.. {1509804000 46800 1 +12}.. {1515852000 43200 0 +12}.. {1541253600 46800 1 +12}.. {1547301600 43200 0 +12}.. {1573308000 46800 1 +12}.. {1578751200 43200 0 +12}.. {1608386400 46800 1 +12}.. {1610805600 43200 0 +12}.. {1668261600 4

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Funafuti

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):154
                                                                          Entropy (8bit):5.018668544746349
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDH4QwyFPMXGm2OHwodGeoHvmcpXrWXVN0UIoAov:SlSWB9eg/BCPDm2OHwxeoHvmgSX0YAov
                                                                          MD5:C1547FDC362DA1162FE7B53BC16AEA87
                                                                          SHA1:3249423B61C42E6CE54A77BACA0A8FDFD2594CF9
                                                                          SHA-256:B2ACF1461318A0B21653B6F21DE5E54651A417A469AAD0DBF8099626040BEB51
                                                                          SHA-512:76D0F4489CCB32A8CDCA5151E086E93A0199C6FF5066DD73F873F103F7592BFE4A3765BC862246817C2F0CA7F33B02EF40E5A3C9CF461A07D9AF03F623FC08FB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Funafuti) {.. {-9223372036854775808 43012 0 LMT}.. {-2177495812 43200 0 +12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Galapagos

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):247
                                                                          Entropy (8bit):4.687336389955113
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/fEGDm2OHvQYeoHTie7KVQRncRvinrN5/uFifriX:MB86fhmdH0CTV7OcdrN5/uFiGX
                                                                          MD5:0557D164DCD8DF5D99F7AF5A2AB1AD4F
                                                                          SHA1:68AFD04303E5F541480425405D82E1827F78A8DF
                                                                          SHA-256:192545659F971084ADC8489A2B96A6439FF391599DC962AA13375ACCFB3C09D9
                                                                          SHA-512:1DA004E51F8E7A712EDE920CBB62E81F9F55450FB52B62F78F1CD4F8F4E342B4DAB2C28AA5161E8B24942A7A5BD55F978AFDA1C5E1949241E71D738079DEF9B8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Galapagos) {.. {-9223372036854775808 -21504 0 LMT}.. {-1230746496 -18000 0 -05}.. {504939600 -21600 0 -06}.. {722930400 -18000 1 -06}.. {728888400 -21600 0 -06}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Gambier

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):155
                                                                          Entropy (8bit):4.976931060677737
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDH5hBYfMXGm2OHKToxYoHsdNfis:SlSWB9eg/DDm2OHPxYoH4qs
                                                                          MD5:45330CE0FA604304C6ACF8EF8CAF51EC
                                                                          SHA1:20EEF9646996C2EC9B2641EBCCBE4766BF38B17B
                                                                          SHA-256:190E02A0C00D165FA45C73AEF9C0D6C82B1720E7406E5610DD860AED10A021A5
                                                                          SHA-512:51C7931B503405DA0B4078F6BE411895DD00E86AC7C5BE475030664D5302AD614293541DEE7FFC3D86A9DDB1BDA32BCAA746CF1D207DB063FBA2F9E9BE12836C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Gambier) {.. {-9223372036854775808 -32388 0 LMT}.. {-1806678012 -32400 0 -09}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Guadalcanal

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):157
                                                                          Entropy (8bit):4.9796189407775255
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDH5RyJTLJ5FNMXGm2OHddHvpoxYoHsdMWdHPVtyn:SlSWB9eg/LJHjXDm2OHdFGxYoHgHPLy
                                                                          MD5:DF09960360D8CEDCA2A4DC19A177C4A6
                                                                          SHA1:9F73F271B8C85B25FE6392B8BF7465C92EFFE621
                                                                          SHA-256:161762334DFF48B1D58824911E1FF4171386EA18234DD3DD5B0798515593086A
                                                                          SHA-512:1BE9E0F90DA529C99E317F399BFDB913A076651CF8801A1849247B26A350A76D8B5807AB139F3DBB97790DDFC332BDBEB57B364BF67FA2BB440AFEDC4130A648
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Guadalcanal) {.. {-9223372036854775808 38388 0 LMT}.. {-1806748788 39600 0 +11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Guam

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):733
                                                                          Entropy (8bit):4.244282318063802
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB862mdHanCTCtBCv1yWQkHHLTaWJ+x+87W0x+8+yWSi+JW7+sWU0dwaW1j+FaW2:FeaC2twvY3knLGs+I87p+8d9i+J7s70c
                                                                          MD5:BA319E451BE323C852A8ABFC299DDA28
                                                                          SHA1:FC9314C162FF1FE1ED5E2C5DF962A55D4D6D8115
                                                                          SHA-256:42CB69ABC83415F63CA7D2A3E5314A41817AEE3206ECCC7172C50A74B1597DB0
                                                                          SHA-512:3BF733B9ED2A57B01BE173A8421B2D5A45888A230461EA0BD8C5B4AC7DC010BB527346731196141C70AFECDF88DD47AFE48636243DFC395D88E58231BEDF7D2A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Guam) {.. {-9223372036854775808 -51660 0 LMT}.. {-3944626740 34740 0 LMT}.. {-2177487540 36000 0 GST}.. {-885549600 32400 0 +09}.. {-802256400 36000 0 GST}.. {-331891200 39600 1 GDT}.. {-281610000 36000 0 GST}.. {-73728000 39600 1 GDT}.. {-29415540 36000 0 GST}.. {-16704000 39600 1 GDT}.. {-10659600 36000 0 GST}.. {9907200 39600 1 GDT}.. {21394800 36000 0 GST}.. {41356800 39600 1 GDT}.. {52844400 36000 0 GST}.. {124819200 39600 1 GDT}.. {130863600 36000 0 GST}.. {201888000 39600 1 GDT}.. {209487660 36000 0 GST}.. {230659200 39600 1 GDT}.. {241542000 36000 0 GST}.. {977493600 36000 0 ChST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Honolulu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):344
                                                                          Entropy (8bit):4.640604617840767
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/PeDDm2OHsVVoHvBrai3UNFv+rUXaWFvAHovj/0nvCv7p+v:MB86WXmdH0VCvBz0GOTA0/0y74v
                                                                          MD5:F3F0E64655FAA79E40860765EEBB5B77
                                                                          SHA1:7F6C2FC100AEABC26B7205AB53C1E016B12E4D60
                                                                          SHA-256:69319015799D32D3CF7C0A3E9991B4B1F3E0C5D1B4FBF400517350CCA9D2C3B7
                                                                          SHA-512:7C9238BCCB13B90D4DC9B5E776C421A42C25D21B4E026406F57FA1E70983E8F6BF1CE927AB9D0D6261C5C1802A8B810399F506915262F82F487417CFD704B2F1
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Honolulu) {.. {-9223372036854775808 -37886 0 LMT}.. {-2334101314 -37800 0 HST}.. {-1157283000 -34200 1 HDT}.. {-1155436200 -34200 0 HST}.. {-880201800 -34200 1 HWT}.. {-769395600 -34200 1 HPT}.. {-765376200 -37800 0 HST}.. {-712150200 -36000 0 HST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Johnston

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):193
                                                                          Entropy (8bit):4.844454917943834
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3yc6e8SHAIgOb6eKAN/NWyVheo:MByMdniinbtNWzo
                                                                          MD5:4244078A03C2493009EF2F6BDA2F326F
                                                                          SHA1:AC2FF3E91A8831A479B33DF32A0118BC2EB255D0
                                                                          SHA-256:6E52B361AC8A6A578C709F6D58AA7535F06C0CB1707081C2D5A63FA8545D955C
                                                                          SHA-512:398B32E0FAF80E40DF3ACD203DF380D61DC39322F0BA0388A18281BC26973945F45683A104B9A785BB9DF5E514322F6994F934289E4B56B7982F94D4528D4272
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:Pacific/Johnston) $TZData(:Pacific/Honolulu)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Kanton

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):208
                                                                          Entropy (8bit):4.669308556946547
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/KyXDm2OHEMmzQwXy29BVyv7y/fTVVFty:MB86KyTmdHEZzQUBVyDy/fZvty
                                                                          MD5:544A0A83241333805192A6F03888E359
                                                                          SHA1:99D2BE79D57B44BD538386F9E7551C9E1874D7E3
                                                                          SHA-256:0B1345555EC2B4738CC4DEBFE496C287966F238386263032FF1E27912CCBFBA6
                                                                          SHA-512:61C91265632D01FBB7F4C739368756C428258FA6C141E49E88B6C78ABEA6150A74B8DFCF14C5AADDA03C1EA6F04D122734654495C26B8614561786B1C5C7EF10
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kanton) {.. {-9223372036854775808 0 0 -00}.. {-1020470400 -43200 0 -12}.. {307627200 -39600 0 -11}.. {788871600 46800 0 +13}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Kiritimati

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):219
                                                                          Entropy (8bit):4.739672105601744
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/iSDm2OHjkeoHvmLVFFz4YWXfSzvjNv:MB86iGmdHpCvU4VfSbxv
                                                                          MD5:1B695BBB9C50F6AFC05F67DE30374160
                                                                          SHA1:08AD8BBB6C99EB36FC3E462DB41C6896F52F150C
                                                                          SHA-256:4F7235B956A5A01676BE05275E086D5157EBC24FD91022E87817020669F915F7
                                                                          SHA-512:DC35CB1C2E5E035A82F91D1B1F4B48D7B112D9B7A1A7DB9C4A4C42C4D58002E1ECD9D24B2EA5B624DBB526ADDF9A8AB37D4315843207C34C16B2EFE33A254752
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kiritimati) {.. {-9223372036854775808 -37760 0 LMT}.. {-2177415040 -38400 0 -1040}.. {307622400 -36000 0 -10}.. {788868000 50400 0 +14}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Kosrae

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):394
                                                                          Entropy (8bit):4.441317927120857
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB869nmdHlCTvrvCvKcHwzHHI/HKOjHHwZaLYkcy:2ecrrqvGznISknwZaLxcy
                                                                          MD5:B489D7BDE8EB805B2A24726A6FB0C441
                                                                          SHA1:7997A33AA56857EC52B1198DBEF4CE1DB50D69FD
                                                                          SHA-256:B528E5E712E5F878603183E7CCFF55E5DB97CB47D7628BCB635342796317B899
                                                                          SHA-512:4898AC2747FB8620BE29933CC7AA344AF1A3B7777D1AFF08BB4C6CE6E7AF205581937CCB488F3CB39CC8CA7FB42EDC8E1CAD8BADC9FCA40E3CAD23271CD66FCB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kosrae) {.. {-9223372036854775808 -47284 0 LMT}.. {-3944631116 39116 0 LMT}.. {-2177491916 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 39600 0 +11}.. {-7988400 43200 0 +12}.. {915105600 39600 0 +11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Kwajalein

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):304
                                                                          Entropy (8bit):4.5947337310364835
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/yEyDm2OH4T2eoHvmfKnOjvScHrkL/Xy2185k0YAov:MB86XmmdHWCv6KOjHHgLN8tby
                                                                          MD5:7D1FC9913941693ACBD6A3CCB2F34555
                                                                          SHA1:D07C8AAED1DF9614BCA6EEF0F72FB98BE46CF5EF
                                                                          SHA-256:38133BE70100D7DC244A680827879E6B240646C7C0B68F58652051E681A71985
                                                                          SHA-512:419F0A1D1D71C8F84765C7B54271D7EFD6A81F428751523A214ABB24A8770DD5A7666F634A20AF97D5AAB8F21C0DEF23DCDE068CF4C1CCC7639ABC43864A9DBC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kwajalein) {.. {-9223372036854775808 40160 0 LMT}.. {-2177492960 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-817462800 39600 0 +11}.. {-7988400 -43200 0 -12}.. {745934400 43200 0 +12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Majuro

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):333
                                                                          Entropy (8bit):4.49621343701744
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/QpDm2OHyexYoHvmf/aHwzvScHoVv3HKnOjvScHr8e0LYX0YAov:MB86cmdHyuYCvMiHwzHHI/HKOjHHYe0I
                                                                          MD5:CA7ED52987F13BA6A3043C324F72C3D0
                                                                          SHA1:F5798473DB3A9AA588E5F0D772AD2145A90DE707
                                                                          SHA-256:67EA1A2A84E0FA686C04EF327E7EEACCC15E21BED79A801E64BB57FE4184509A
                                                                          SHA-512:4EA25564E1430615D0FE75319B3CFC88E3FB7BCE026B4C59842FC513CBE7BFF3AD39CC283ED88DD7292DFE8185ACECD5E1ED0D5997F27082F3F6B2D1317D86C3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Majuro) {.. {-9223372036854775808 41088 0 LMT}.. {-2177493888 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-818067600 39600 0 +11}.. {-7988400 43200 0 +12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Marquesas

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):159
                                                                          Entropy (8bit):4.976348164850869
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHzrHeWNMXGm2OHOx5oHsdNpNFvvIVVFvYy:SlSWB9eg/cHeSDm2OHOnoH4/FvQVVFAy
                                                                          MD5:80CB45F42BAB1AA72CD7C7BC394DF3F8
                                                                          SHA1:8B5ED2BCCA1AEB41F22AFD14F46533959828B2BE
                                                                          SHA-256:AE0B5055C6E57516F23749B13681205EAD376E682959716A457B1377AF8160BA
                                                                          SHA-512:71562E340B7A96B91D04FCBCAF71B66EA725CA1BD1094343C4442F8F9A8C67A3BE378034849197407D21C3EE74E2C753B1FD3BAFF2378714B993AD9336236A0E
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Marquesas) {.. {-9223372036854775808 -33480 0 LMT}.. {-1806676920 -34200 0 -0930}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Midway

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):194
                                                                          Entropy (8bit):4.81307101485774
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/nUDHz0HvUDHurKv:SlSWB9vsM3yciemHAIgObiecN/Zevn
                                                                          MD5:13CE48F8FF74BFCEFCB8D217D6357E38
                                                                          SHA1:296D31E3F868934C6EB34BF1BF4C23F3E1839294
                                                                          SHA-256:F62C6A2DEC1E9EC78115D5F14E5B9DB7C86F788662D2E68F7E6714F4A05DC974
                                                                          SHA-512:778813FC08EF803743F392000BECE73C1C079883DAFC26FAC0AF8FA3FA4AE1D94BA8F3CAA5E82DD4DB1A5F12AD49E123901908F5483E0E325952622AB4C4A26A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:Pacific/Midway) $TZData(:Pacific/Pago_Pago)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Nauru

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):244
                                                                          Entropy (8bit):4.702705620563736
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/JdDm2OHceoHx6sCH/ZdqvScH9cd0YAov:MB86J5mdH9CMhcHHauby
                                                                          MD5:30A8285FCCE2E98889E53DF60B906C3D
                                                                          SHA1:C7789CB11A2C8FE3861FF3C0A7A41F6CAFD87631
                                                                          SHA-256:22C367F3219B5FC736260D9DBFEF5FCB767F1A6BDA991C9352F790A3D1FFE884
                                                                          SHA-512:02DA82680588839B06F820979AECC78B7FBEAB9D6D49176B513B80F1C8BA2D55FB3674B19EFDD574EE6FC01539EF7C3081A4B34D14A54DACF367D816B62E5843
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Nauru) {.. {-9223372036854775808 40060 0 LMT}.. {-1545131260 41400 0 +1130}.. {-862918200 32400 0 +09}.. {-767350800 41400 0 +1130}.. {287418600 43200 0 +12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Niue

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.846897598147338
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHwMQA3WNMXGm2OH0SNoHoRWVGXyOyovFaSUGFAZvBByV:SlSWB9eg/Jm3SDm2OHJoHFGXCodZUGFd
                                                                          MD5:6E8EC957423917AE7A7EF503661C1A77
                                                                          SHA1:B4FA3C3E3F96C28B7DB87BFD441D2EE99CC81B6F
                                                                          SHA-256:869CCA656BE88E4E7481C75737C3656BAB6924AD1751505815AC719C59269842
                                                                          SHA-512:9047ABE673259699C7A548BC7B5636DD646DD382C751B796522F65404162AB1B0BB022FD274653921E5B23C847EE248AEF6749E15ED2CFC1DCE35BBA294D8251
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Niue) {.. {-9223372036854775808 -40780 0 LMT}.. {-543069620 -40800 0 -1120}.. {-173623200 -39600 0 -11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Norfolk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5139
                                                                          Entropy (8bit):3.65794255179185
                                                                          Encrypted:false
                                                                          SSDEEP:48:K/yg8hZbeS07HbbYTqge+gDrWnAxhejtB0e+Pwn1UVimqNQrKvyXrStkCDv:K/y7hNeS07sq0Erk10lINQrKvyXrwv
                                                                          MD5:E19700A894AA64715D14F501D8D2FA98
                                                                          SHA1:57CFC96E2EBB985720DB290F59181860AF2AC1AA
                                                                          SHA-256:5D16C3EF1DB996C1B8E33AD884C33946F77DA872F35F41EC3BD5B288F43CC9AF
                                                                          SHA-512:E11EAF2A7B217CDBEECB57635184F04171F0DB088FCC4702AA8D40A3A5453904592F5869849913E2EB02DC5941C84203A76D270E8930B0B691A3B9C39B78BF30
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Norfolk) {.. {-9223372036854775808 40312 0 LMT}.. {-2177493112 40320 0 +1112}.. {-599656320 41400 0 +1130}.. {152029800 45000 1 +1230}.. {162916200 41400 0 +1130}.. {1443882600 39600 0 +11}.. {1561899600 39600 0 +12}.. {1570287600 43200 1 +12}.. {1586012400 39600 0 +12}.. {1601737200 43200 1 +12}.. {1617462000 39600 0 +12}.. {1633186800 43200 1 +12}.. {1648911600 39600 0 +12}.. {1664636400 43200 1 +12}.. {1680361200 39600 0 +12}.. {1696086000 43200 1 +12}.. {1712415600 39600 0 +12}.. {1728140400 43200 1 +12}.. {1743865200 39600 0 +12}.. {1759590000 43200 1 +12}.. {1775314800 39600 0 +12}.. {1791039600 43200 1 +12}.. {1806764400 39600 0 +12}.. {1822489200 43200 1 +12}.. {1838214000 39600 0 +12}.. {1853938800 43200 1 +12}.. {1869663600 39600 0 +12}.. {1885993200 43200 1 +12}.. {1901718000 39600 0 +12}.. {1917442800 43200 1 +12}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Noumea

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):326
                                                                          Entropy (8bit):4.531117764974758
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/JcSDm2OHTYoHgnX2czO/FxgV62JFy:MB86JcGmdHTYCgX2czUjgM2ny
                                                                          MD5:2F1E92A11DF44C72DC305C13111DEA35
                                                                          SHA1:847F551C3D6C75CD2D0D6D87FCF3294CA8DD90B2
                                                                          SHA-256:238683C027D2319C33D975A837E9FC9D24DD53B1A67108EDBF7ABDF0DB050881
                                                                          SHA-512:E35D8C71AFDBB9A7507E873925001AEDE3734B1D235F509D19952E85279CBCC233A73412EA1F79CB534A45D36FEAA8AFDA98D9964DC93C7892B318F4AFC9A076
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Noumea) {.. {-9223372036854775808 39948 0 LMT}.. {-1829387148 39600 0 +11}.. {250002000 43200 1 +11}.. {257342400 39600 0 +11}.. {281451600 43200 1 +11}.. {288878400 39600 0 +11}.. {849366000 43200 1 +11}.. {857228400 39600 0 +11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Pago_Pago

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.985607855830399
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHurKeTFfXMXGm2OH2ivkeoHvUPi1TsYoHsdfWTVvvVFv:SlSWB9eg/XecDm2OH23eoHvWieYoHiWB
                                                                          MD5:E86D90DAA694B0EAC42F8C01346BC95B
                                                                          SHA1:CD29DEFC291C939296E86DC7EF5D0654D85285E8
                                                                          SHA-256:CCA96640AB3BC707224FA86D9AF66F9D53A204A97B370B2785BA8208688BF8B6
                                                                          SHA-512:937BA420061E3781F831779B458E914A0FC465C4B41796F8B7CB1E548822F5777A6450FC6002AB13EBC5C9F54E374D3ED731D05B2B302B95359BE34094E5062B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pago_Pago) {.. {-9223372036854775808 45432 0 LMT}.. {-2445424632 -40968 0 LMT}.. {-1861879032 -39600 0 SST}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Palau

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):183
                                                                          Entropy (8bit):4.919381181565273
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHugEZF3fMXGm2OHKvkeoHucRbgnJnoHvmdQ4+vScFAy:SlSWB9eg/Xg2PDm2OHK8eoHTWJnoHvmi
                                                                          MD5:2E6C7EC61C7E29A147475C223B163F6B
                                                                          SHA1:3A98D3441335224E7EBC0648990BCA1DE3BDF5C6
                                                                          SHA-256:97DE6C2C717BFEAD00F83B5D39D654C32CEE580226F5F084484EBAD57BBCE7FF
                                                                          SHA-512:5868C43966DDEBA8EC4BBBB29CDFDDFF0C7B01FD4D579FF655F3363029059F969B39C9221190672B6A2F7938583594AA0B103FC2A7ED573E2BC1C3A1623DE8DD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Palau) {.. {-9223372036854775808 -54124 0 LMT}.. {-3944624276 32276 0 LMT}.. {-2177485076 32400 0 +09}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Pitcairn

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.809907977056877
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHuQTWLMbNMXGm2OHUVFvoHvmXUlgloWkcyf/vGpn:SlSWB9eg/XQyLMJDm2OHUVVoHvmXUKm2
                                                                          MD5:3F4987676F9C461895EDF9985AD22E06
                                                                          SHA1:A96E470209010B837EF5BB3AC93BAE74BF2CCF64
                                                                          SHA-256:5D363729A986E24C79F4B817CC88D2B22ACCCE3ADD20138D51C4422C4297AD6F
                                                                          SHA-512:988FB98EFD3F57F5D66A932CC6B9D0387E9B0951FC590E08DAF19ACF5E4F39BC1B25265F16E14930BCF394902F5F0EF507E0E91C98902DFB10FA16D716091AB0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pitcairn) {.. {-9223372036854775808 -31220 0 LMT}.. {-2177421580 -30600 0 -0830}.. {893665800 -28800 0 -08}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Pohnpei

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):338
                                                                          Entropy (8bit):4.55704384204571
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9eg/XyiDm2OHANgYoHT6WKNoHvmScHwzvScHoVv3HKnOjvScHb0Zzy:MB86C2mdH1YCT61NCvfcHwzHHI/HKOjX
                                                                          MD5:497B7BE4CE7A51C19CE7D4DDC3109281
                                                                          SHA1:5ED794E3B95A99CF1B9520174A15396A3A8ADF28
                                                                          SHA-256:88D62B644BB96A9318427B4CA56DB37C8217DA449328C801ED77007BE9420F9C
                                                                          SHA-512:2E0898F7135E1634298BD5DE73F129433F9DA47E6F08E5A58D83A4DF4F6FC0F54B6FC2660B0EE4C13561A925841B160B893D4A21A0622125D2E3DC66883C5080
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pohnpei) {.. {-9223372036854775808 -48428 0 LMT}.. {-3944629972 37972 0 LMT}.. {-2177490772 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 39600 0 +11}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Ponape

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.786230343954939
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGuySeyXHAIgObTuyoAFARL/nUDHu3HppUDHuyB:SlSWB9vsM3yciySeSHAIgObiyJAN/X3y
                                                                          MD5:D32F290A7020C13D7A130A0548112B02
                                                                          SHA1:314877B3C316D7BD9962DE18A9D57A59556E0D95
                                                                          SHA-256:EDC43EF78691A1B22D111BC4390EA442B893E61771A6FD76BDAE1D46C5904C0C
                                                                          SHA-512:9054C22EA382CACE946FE08F0118E2A4120DE4FF1F3FA908869E4BFA20D2DF8AED0DD5F169871BD09743563639F6E24C7DB8BBFB3A7268DE15DB7CCAFE622192
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pohnpei)]} {.. LoadTimeZoneFile Pacific/Pohnpei..}..set TZData(:Pacific/Ponape) $TZData(:Pacific/Pohnpei)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Port_Moresby

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):190
                                                                          Entropy (8bit):4.945354510868153
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHuwKXI3SMXGm2OHwdvoHvZUeQTnoo3v/vnqMVVMUMy:SlSWB9eg/X/43SDm2OHwdvoHvZZQTnoQ
                                                                          MD5:2CFB7C2A3D26D7AF0F6AE32ADD81C364
                                                                          SHA1:80C96E50D23A9A9531E4EE33744CF445C054B901
                                                                          SHA-256:124C137B091D9D54D5E0579131485428FAAE040ACC978D20D6A8C8E4DE9889AA
                                                                          SHA-512:A215FF5A69BD3E786BD3F8C952C8593396402EFA85005F5342093028617A6862EAE8BFD7B6D5737F90D90897AB62CF785544A4157A222AE4D0F70797FFBEC2CB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Port_Moresby) {.. {-9223372036854775808 35320 0 LMT}.. {-2840176120 35312 0 PMMT}.. {-2366790512 36000 0 +10}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Rarotonga

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):969
                                                                          Entropy (8bit):3.943959457262612
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86VrjmdHI5Cvn9HCFkN00hjNFq++UE+q0hwA+A7VxVnDEFn:IeZv8w0MNFq+xE+uAtx1c
                                                                          MD5:64AD3A103F4D145C48484BF8FACF41C2
                                                                          SHA1:40C00CFA56C87E506C254A93A164D7227DFF3BD5
                                                                          SHA-256:5AB006A686E564E30C94884FF8A9D728AEC74681DA8772E9722B6FE203630B5D
                                                                          SHA-512:D1088C3B673B5456A8706B69BE4D7AB18615EE53A82BF4ABE76E86700837E6BAD0BD79C13EDA9B04776B08A95B835BA755AA565F86E45BFE507E8783896C1EE2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Rarotonga) {.. {-9223372036854775808 48056 0 LMT}.. {-2209555256 -38344 0 LMT}.. {-543072056 -37800 0 -1030}.. {279714600 -34200 0 -10}.. {289387800 -36000 0 -10}.. {309952800 -34200 1 -10}.. {320837400 -36000 0 -10}.. {341402400 -34200 1 -10}.. {352287000 -36000 0 -10}.. {372852000 -34200 1 -10}.. {384341400 -36000 0 -10}.. {404906400 -34200 1 -10}.. {415791000 -36000 0 -10}.. {436356000 -34200 1 -10}.. {447240600 -36000 0 -10}.. {467805600 -34200 1 -10}.. {478690200 -36000 0 -10}.. {499255200 -34200 1 -10}.. {510139800 -36000 0 -10}.. {530704800 -34200 1 -10}.. {541589400 -36000 0 -10}.. {562154400 -34200 1 -10}.. {573643800 -36000 0 -10}.. {594208800 -34200 1 -10}.. {605093400 -36000 0 -10}.. {625658400 -34200 1 -10}.. {636543000 -36000 0 -10}.. {657108000 -34200 1 -10}.. {667992600 -36000 0 -10}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Saipan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):179
                                                                          Entropy (8bit):4.854594370903023
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG5RFeyXHAIgObT5RV5RL/nUDHtluKpUDH5Rgn:SlSWB9vsM3ycdeSHAIgOb7N/vKbn
                                                                          MD5:EFC985F07B24BEDA22993C9D0EA7E022
                                                                          SHA1:6D05D12925621F1D05999A5DCC81B8C6F4D18945
                                                                          SHA-256:4F6A1C20A11E186012466091CD4B3C09D89D35E7560F93874DEC2D7F99365589
                                                                          SHA-512:5FB4D8784D2EB8AEF660D6CBC7C403561EE5874BEC0439762F3688C64830B52B1F557B467CA65B64B1210E82F385E134BF676F3CA443FB480702A2C90B3C3757
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Guam)]} {.. LoadTimeZoneFile Pacific/Guam..}..set TZData(:Pacific/Saipan) $TZData(:Pacific/Guam)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Samoa

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):193
                                                                          Entropy (8bit):4.78073436515702
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/nUDHthA5nUDHurK:SlSWB9vsM3yciemHAIgObiecN/NXevn
                                                                          MD5:8E335F5D0A2082BB673E7FEB56167A89
                                                                          SHA1:EF37235922D4477AC9B3D9576888CDE41E700741
                                                                          SHA-256:98D06302EFC18FAD7751F7E5A059FE4ABAFBC361FDC365FE1EB576209D92C658
                                                                          SHA-512:2572D99EE8BAF264B8A2EF3D7647D33A387EE83E036F9E7BDB21F64C2FCB43317AF9C899C8CDD822A2A5A207EF17504E71B217370473ED95AE925BBA2CFA90F9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:Pacific/Samoa) $TZData(:Pacific/Pago_Pago)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Tahiti

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):154
                                                                          Entropy (8bit):4.946903999617555
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHqhFPMXGm2OHl/oeoHsdNqRU7vV:SlSWB9eg/TTPDm2OHloeoH4qRW9
                                                                          MD5:341B0F535043051A91A21297BFA39DC0
                                                                          SHA1:6AD9177FC237503E6D36DE5408790A68D5D36E2C
                                                                          SHA-256:440A87DDB4F304DCBEAED1B0DE8F6058840E597918B688E0782F584DA03B1BBC
                                                                          SHA-512:D97D399A0F1B4347F8AE5F15E43A8787697339AB0EFB4E1106C790528FFC529ADC5B44B231D95449D39DB464D84A5DDF7B61E7D190E3E2B0091D1EC204B530A2
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tahiti) {.. {-9223372036854775808 -35896 0 LMT}.. {-1806674504 -36000 0 -10}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Tarawa

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):152
                                                                          Entropy (8bit):4.969953728206455
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHqQ3fMXGm2OHyyFpoeoHvmciRrWFN0UIoAov:SlSWB9eg/T+Dm2OHyyFGeoHvmbu0YAov
                                                                          MD5:AA67FBBB6A02F5B30486C54E3A5C11D7
                                                                          SHA1:C64FD3654A47A0ECDD681B8A4D9B621AC6D97DBE
                                                                          SHA-256:91AA5DA8D5D1E72B1F561D0AEAB4B07E02EDD4EB95AE8C9F1C503C820460599F
                                                                          SHA-512:FC170904098011C091622A263CA554CEE952D64888D3573EB324E0A262E1A0C0885C059429F0FFF9219FEB8F1B6B97EC34661DD8DD547124D0C6C0A1C8EE24B7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tarawa) {.. {-9223372036854775808 41524 0 LMT}.. {-2177494324 43200 0 +12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Tongatapu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):451
                                                                          Entropy (8bit):4.343299747430587
                                                                          Encrypted:false
                                                                          SSDEEP:12:MB86PmdHmCdC/V7XZXw8Ut2rbUtGiAUtb4bUtqVy:iemn/VbKeOSy
                                                                          MD5:87CFDA2399A8126117E5BFC018B06518
                                                                          SHA1:6291611BCFB34293F9C20BA77170A13C1502C2ED
                                                                          SHA-256:ECC9D2E7AD7B5E5D6599CF442941595C99C4D69E802A4DDB4DA321898CDDE91D
                                                                          SHA-512:846FE07FEB82EC5F87FAE137D23074934246DBB7C7EE30F44F6C5373183B5FD2211B58E5CF1AB9A47938D282CA322FBDE80B58054FE6517CDC549992439F19A8
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tongatapu) {.. {-9223372036854775808 44352 0 LMT}.. {-767189952 44400 0 +1220}.. {-284041200 46800 0 +13}.. {915102000 46800 0 +13}.. {939214800 50400 1 +13}.. {953384400 46800 0 +13}.. {973342800 50400 1 +13}.. {980596800 46800 0 +13}.. {1004792400 50400 1 +13}.. {1012046400 46800 0 +13}.. {1478350800 50400 1 +13}.. {1484398800 46800 0 +13}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Truk

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.913386161054243
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG9CoveyXHAIgObT9CuYFARL/nUDHqAOsvUDH9Coy:SlSWB9vsM3yckGeSHAIgObkXFAN/TAO2
                                                                          MD5:643A77CAA5D7E031418C150A2D114BC4
                                                                          SHA1:BE00B59D7AEB6AAB871D87A1C6243233833C4539
                                                                          SHA-256:BDD8C779AF9D671AD7F20832FFF8EB3B25C9989A619C23337743F112FF4C8764
                                                                          SHA-512:1CC7BFC35FB4FFE9517F0E6C9CA52E4FC71BFBA9E85F77773E490BCB3EF5F0C041E3C24A08A9A39F749161AB6F4027F703A254CF6158C1AC31E9CFBDBAAA2A45
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chuuk)]} {.. LoadTimeZoneFile Pacific/Chuuk..}..set TZData(:Pacific/Truk) $TZData(:Pacific/Chuuk)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Wake

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):150
                                                                          Entropy (8bit):4.981440234973766
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHpDFNMXGm2OH4VkxYoHvmcDVv0UIoAov:SlSWB9eg/8Dm2OHYkxYoHvmyv0YAov
                                                                          MD5:11F5DFD4F782517FAEFBB7D7FEF3CED6
                                                                          SHA1:B511E65FCB17E8910E347DE1C94B5BCF1A9A6081
                                                                          SHA-256:2D18D9AB10C9D8947A88D486D0BC0B0523049A2ED2CA2FBDFA0577E40F189D13
                                                                          SHA-512:0F72C4ACF54758B61ECC4584B86C0257178D0A82C98076C56B417DC4D0CB6743FD1D47E5DBC5EE9635E8297704C86F6841DB4704706C96F89F47D0CE55883230
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Wake) {.. {-9223372036854775808 39988 0 LMT}.. {-2177492788 43200 0 +12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Wallis

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):152
                                                                          Entropy (8bit):4.977211872736631
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QF08x/nUDHpEYdNMXGm2OH3UPoHvmcCRQH0UIoAov:SlSWB9eg/tiDm2OHkPoHvmiH0YAov
                                                                          MD5:DA5CFD5BFC06355B732CAFB11B2BBBCA
                                                                          SHA1:5AA3838C8799CE33D261331971E42494E2A88041
                                                                          SHA-256:A3D83E6C504EAC75C4CD87B696F0DF2703D0A78DF27D8B1FAC161ACB07F2A9DE
                                                                          SHA-512:95444BDD838DAF8C4B70BFE0345C7437DF5E1FA8BF3C8E4AD43C3F9887B2B4A1885E8EDDBE5EF7306BEBFBF597A662603001A5EF4144F204A6EDAB9A5D671EC0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Wallis) {.. {-9223372036854775808 44120 0 LMT}.. {-2177496920 43200 0 +12}..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Pacific\Yap

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):179
                                                                          Entropy (8bit):4.935135597072032
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG9CoveyXHAIgObT9CuYFARL/nUDHnHPUDH9Coy:SlSWB9vsM3yckGeSHAIgObkXFAN/eBl
                                                                          MD5:BF20184F9BBBE1E43490F93E97DA202D
                                                                          SHA1:D44B0A82DCE2131BDB52BFE70B8B59F412551B52
                                                                          SHA-256:E348A2D02966CF9599B5F6F1F5B6C3412113DEF548BD322F0C22376106E12D92
                                                                          SHA-512:C1BA813BB3F8628866C1042669051C2763FD2B13CA724CB91F0BEC0CF97D77FFF353157036C789D3589238D7FC013FB61248356CFB8D14C54D9EE525AF2D1331
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chuuk)]} {.. LoadTimeZoneFile Pacific/Chuuk..}..set TZData(:Pacific/Yap) $TZData(:Pacific/Chuuk)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Poland

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):174
                                                                          Entropy (8bit):4.940195299412468
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVqEGIV5XHAIgoqpEGYvWARL/nSi67x/yQa0EGIy:SlSWB9vsM3ymc4HAIgocVAN/27x6qF
                                                                          MD5:E6AA2F6A05B57AA9B4AEF8E98552EEB2
                                                                          SHA1:22470C204152702D8826CA52299E942F572C85ED
                                                                          SHA-256:C27E1179B55BF0C7DB6F1C334C0C20C4AFA4DBB84DB6F46244B118F7EAB9C76E
                                                                          SHA-512:B28A264907C32F848D356FB0F5776C2CE819DCB6BC08A5E2DCD4FA455EE1616966E816748079C7A55485BABFFB292D567E6F958168F945889E33A267B0E7EDA9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Warsaw)]} {.. LoadTimeZoneFile Europe/Warsaw..}..set TZData(:Poland) $TZData(:Europe/Warsaw)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Portugal

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):176
                                                                          Entropy (8bit):4.9353841548970205
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxMvLS3vXHAIgoqyMvLL6RL/nM24h8QavMvLBn:SlSWB9vsM3ymvMv2PHAIgovMvH6N/e8i
                                                                          MD5:7D7BD6E40D3ADCA04754255D69B5CC9D
                                                                          SHA1:EE32167B450DE7B0F1A15199795AEF9524BE623B
                                                                          SHA-256:EFD666F3062D52C5D0B4F83B1A206E6840C1EAEC356CD77A0A71C7EDFA78C964
                                                                          SHA-512:6056AAF078316A89079D19555F0BAEFB4C1CDBAA5426A8BEE76E0BFA5C69A5DAAFD199DEF978ABD67287AE1B80F754B7845EAFD5CC0995FE10E44D1F34D5435C
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Lisbon)]} {.. LoadTimeZoneFile Europe/Lisbon..}..set TZData(:Portugal) $TZData(:Europe/Lisbon)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\ROC

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):165
                                                                          Entropy (8bit):4.795776391333205
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qMveyXHAIgNqBLFARL/lOr4WFKfMy:SlSWB9vsM3yKMveSHAIgcBJAN/S4wKfB
                                                                          MD5:C5AE3A1DAD32C870651C74E367F604CF
                                                                          SHA1:9FF81383C43D98441841E182BC783381EF565204
                                                                          SHA-256:9AEC39777013B23D63D0509EBB2F01D57A2C1592264DBB19CE2C61C7D7DDD8DE
                                                                          SHA-512:3A7217ED885011972262B71DB7F5D7E4C9C6E82B4BEEF0718BCB9452E49FDBDD5ED78564156577AB09150140B862E1944B4B739BCE0C50E63667050C35329503
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Taipei)]} {.. LoadTimeZoneFile Asia/Taipei..}..set TZData(:ROC) $TZData(:Asia/Taipei)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\ROK

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):162
                                                                          Entropy (8bit):4.900717350092823
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8ZQckovXHAIgNtvQMHRL/lmFeWFKKQ7:SlSWB9vsM3yJJHAIgbHN/pwKv
                                                                          MD5:59E4C80F97FAFC92987B08BFA03B5EE5
                                                                          SHA1:4F86FCE17A51C3789DEB887BE01A1A0E6EA3D2DE
                                                                          SHA-256:63153B40225270ADB7CD248788CA9F18C6DEBAF222B3165BBAB633337592DF44
                                                                          SHA-512:9FCC0F747096775D0FB8DD252A73E6F47C16BF2D7DB0C3FBDFD206EE57393276FB40F65C1441296AE2AC115CFEE11098474DF3FEF8EE1FABE139427A8991F052
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Seoul)]} {.. LoadTimeZoneFile Asia/Seoul..}..set TZData(:ROK) $TZData(:Asia/Seoul)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Singapore

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.85623787837429
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq801c3vXHAIgNtK1tyHRL/kZ8O5h4WFKf1z:SlSWB9vsM3yUgHAIgWv6N/kth4wKf9
                                                                          MD5:5EABBAAF3B29B5DFF9E54136F7ABC654
                                                                          SHA1:44615F03264012D97512F9AB386413DD72BE1090
                                                                          SHA-256:B9443FB17F0128DDB9F2DF657DC5D2DF176F64C61B0D02B272E5DFB108537678
                                                                          SHA-512:B930D637A1E69E0847ADDEAB013B2C25BC27EBB9CDF20B9CDDFDAC111E9F26BB5EBC83194E845ACC3E1B9A08C386C94FCC4FDE32292EB558E3F7463832BB38B9
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Singapore)]} {.. LoadTimeZoneFile Asia/Singapore..}..set TZData(:Singapore) $TZData(:Asia/Singapore)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\AST4

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):201
                                                                          Entropy (8bit):4.996391010176349
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSNJB9vsM3y7p5oeSHAIgppON/kjx+90ppv:JByMYbpwt8+90b
                                                                          MD5:1AC81E2C60D528A6C5BF2E6867146813
                                                                          SHA1:73D2D24FE6D56CA34ABF11B9A95DC22F809C5158
                                                                          SHA-256:978C4E5256057CE7374AD7929605090FC749B55558495BD0112FB0BB743FA9C2
                                                                          SHA-512:DB2673FB54C1308BBEB298A186F9130FB9090CE33B958C82D62B9BD88EE39BAB9A1BE40645547BA4167FD475892A323CF8EBA16C97F6FDF5693F1BF7A313FE9A
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:SystemV/AST4) $TZData(:America/Puerto_Rico)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\AST4ADT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):192
                                                                          Entropy (8bit):4.9470542553730255
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/kRDwh4IAcGE2NEOyn:SlSNJB9vsM3y7UEOXHAIgpUEqA6N/k+H
                                                                          MD5:2AB4B896957F26B114A990F69989F3FB
                                                                          SHA1:8048C99F5EE02C021F311709B30EB28D650D884D
                                                                          SHA-256:0114C111F5BCD838A28F2E16E01ECB79D8AFC8CBF639A672889ED0D692FC6CDC
                                                                          SHA-512:353744359CD94B1E8184A8B83F762459C69D3AEEA43DA638C1F4CC34E01E9D86C2EBCF7F7BFD059CB23B64051510D1C4556A49D180F8A92DE8449139194DCDC9
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:SystemV/AST4ADT) $TZData(:America/Halifax)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\CST6

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.957831162100758
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/kR/eIAcGEsAzEpv:SlSNJB9vsM3y7hzi2HAIgphznN/kc90q
                                                                          MD5:3EC0B09EAB848821D48849673B24401C
                                                                          SHA1:41599CBA78E124A7DA9744D2B4EA8CDC10008E0B
                                                                          SHA-256:30428B85B37898AD98B65BE5B6A8BD599331D9A1B49605FC6521464228E32F8F
                                                                          SHA-512:9A3303B3338C01B281A40BB48B93C446ADB92BBDC45371667F09EDA92F9EE2AEC60CE8E98CE15C0112B823799C76AEF14895B15DC997DA506494D75BBE58D662
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:SystemV/CST6) $TZData(:America/Regina)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\CST6CDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):192
                                                                          Entropy (8bit):4.975428048518589
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx096yXHAIg20961yHRL/kRwx/h4IAcGE967:SlSNJB9vsM3y796SHAIgp9616N/kyxpQ
                                                                          MD5:D85CCC5EFAA1ED549D02F09A38A53C68
                                                                          SHA1:642ED571E4C6F60A953D42DA4F756F2262E4E709
                                                                          SHA-256:44BEF7D4660A9A873EB762E3FDC651D31D97893545DE643FA1B2D05991C090A1
                                                                          SHA-512:3CC6A14A17EA4833958A7D444073D6C2709FD61BF54387E5C362151E9143F795B2432B621080DD53E0FC9BDD7C58F406E046E3D0A2BBA4132D99E7C705E6D645
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Chicago)]} {.. LoadTimeZoneFile America/Chicago..}..set TZData(:SystemV/CST6CDT) $TZData(:America/Chicago)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\EST5

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):4.928128138328689
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSNJB9vsM3y73G7JHAIgp3GZRN/kkp4903G8:JByMY3G7Kp3GntVp4903G8
                                                                          MD5:506D15E2F37F501F5A592154142A5296
                                                                          SHA1:5ACA12E0BA0FFF9734ED978A9C60AAA9D1E05A59
                                                                          SHA-256:798F92E5DDA65818C887750016D19E6EE9445ADFE0FCB7ACB11281293A09C2C7
                                                                          SHA-512:2EE08D39461CAD3492BE88B421BA463B4CEB8497F036518794BCF605F477057FEA218A9DFBB6335A28A5120750EA06AED9D2EA84CD0007D34CDE562DCD79CC0C
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indianapolis)]} {.. LoadTimeZoneFile America/Indianapolis..}..set TZData(:SystemV/EST5) $TZData(:America/Indianapolis)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\EST5EDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):195
                                                                          Entropy (8bit):5.113680059406992
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSNJB9vsM3y71RHAIgp1aAN/krp4901Yn:JByMY4pltw+90q
                                                                          MD5:AAD8EF3067E97785D4052B80F5C4ACE1
                                                                          SHA1:3EF0A06FCC41119F4A60A32CED0E5A1E0E8B4300
                                                                          SHA-256:D159140114A13C69F073CFE9AD0B67D713E8811CBFF773A3D1681FC38EA0E699
                                                                          SHA-512:A8774ADF6818D85476A6C147A45E55B338F413CD9B61BF9FDB0CB7A335C0CE8F8C6D1970783FEFECC2CE18388DF91304CB295BD4DFD29FB538D74F6A414A441D
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/New_York)]} {.. LoadTimeZoneFile America/New_York..}..set TZData(:SystemV/EST5EDT) $TZData(:America/New_York)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\HST10

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):193
                                                                          Entropy (8bit):4.9733028894475195
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSNJB9vsM3yc6e8SHAIgOb6eKAN/kQmrheo:JByMdniinbtRTo
                                                                          MD5:458061B3F3C8F06C61B5726393A26BA2
                                                                          SHA1:E894F5615654D1110C9964B8F6A54C048442D8EB
                                                                          SHA-256:BF62C8650BBA258000F62F16B0C7CBB66F4FD63F8CFDAF54273BB88A02A6C8D6
                                                                          SHA-512:6A161A7AE44CBF8CE4C704C94456A5B714AAF2A3FAF30731254C9FE056F9DDF207119D516CC6A4C44AE76EC078F5C59F5EC6DD6701FAA3A36F061AF3953B7C7D
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:SystemV/HST10) $TZData(:Pacific/Honolulu)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\MST7

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.999038624718282
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/kRgFfh4IAcGEuto:SlSNJB9vsM3y7OBHAIgpONYyHN/kch4y
                                                                          MD5:B06AB4998A57446FC4D5A5B986BCA0A9
                                                                          SHA1:5E4A28466383CBAB2067B9B6D22882CF6D83C3FB
                                                                          SHA-256:FEBE49FAE260E5595B6F1B21A0A3458D8A50ACA72F4551BF10C1EDB2758E0304
                                                                          SHA-512:9E44174C4E348E1B768039585BA6393FD001B606E111092EEC57C75210A1E87BF3C72728321945D584CA60D4C848D88EB8B2F82CB88F38F90224A43FDCFEA9AA
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:SystemV/MST7) $TZData(:America/Phoenix)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\MST7MDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.956231227702093
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/kRMMFfh4IAcGE6RB:SlSNJB9vsM3y7+SPHAIgp+ON/kD490+B
                                                                          MD5:5D3C1ADB8AC4EAC9E9A31734CD6884BD
                                                                          SHA1:535B024EA088B9B192BE4206CBDD56BC5B163762
                                                                          SHA-256:64556A7B20E425C79375C2A7CCF72B2B5223A7DE4FF4C99A5C039DB3456C63F6
                                                                          SHA-512:FB799A42880613752AD6010D7B4E97ACCF7F6AE281D9A37057F6423AEF2607B608DB2AC52176F1653D8B2D086223C9658B101E73125F0FF7D6D9E8CD876EEC53
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:SystemV/MST7MDT) $TZData(:America/Denver)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\PST8

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):192
                                                                          Entropy (8bit):4.831981174214766
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqTQGuQTWLM4YkovXHAIgObTuQTWLovFvHRL/kRQB5nv:SlSNJB9vsM3yciQyLM4YJHAIgObiQyLQ
                                                                          MD5:B568B46A0207800D9C022BAB1E48709B
                                                                          SHA1:71CE3F0E75E440D5BBA219BCBB92AF9C1F5A7466
                                                                          SHA-256:0B8227AFC94082C985E8E125DF83E5EFADE7CD9CA399800D7B8E8B2BEAE22C7D
                                                                          SHA-512:5067AAD0CD02EBDECA6980F9C7CCC80D076C34D6463C5B6B19B678D76B5E69C1C3639D046F56FE9D6255CBEA49189EDD735F66AD9EE2CB0389BE020E7ED3AD50
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pitcairn)]} {.. LoadTimeZoneFile Pacific/Pitcairn..}..set TZData(:SystemV/PST8) $TZData(:Pacific/Pitcairn)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\PST8PDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):204
                                                                          Entropy (8bit):5.003766957083974
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSNJB9vsM3y7DvPHAIgp5N/kQ1p490Dy:JByMY8p5th090W
                                                                          MD5:7E587175CA0F938C47FA920D787C57BD
                                                                          SHA1:C3F7D8576C0AC74D6B70F4363EE2C174FADC70B0
                                                                          SHA-256:D51D9549835E9C058F836C8952932CB53C10F7F194CD87452E9B13494D1C54C9
                                                                          SHA-512:4460686AAA470F07A6DB1F8957FA4DB600E116273497F46E8A2D3FDECF622122DF753556B78C39FA2ADFDB2AF3C3ABB3C330ADA79B35C6A3CD8C498A0319CEE6
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:SystemV/PST8PDT) $TZData(:America/Los_Angeles)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\YST9

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.9524733332469095
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqTQG5hB5WXHAIgObT5hByY6RL/kRKlUDH5hBpvn:SlSNJB9vsM3ycT2HAIgOboN/kNv
                                                                          MD5:5970A466367825D72D9672293FCD4656
                                                                          SHA1:1A736D61A6797295EEC8C094AED432171E98578E
                                                                          SHA-256:55710EFDED5B5830B2F3A2A072037C5251E1766F318707ED7CD5EB03037FED43
                                                                          SHA-512:1F2A1B2A7D0A3E410652546C174D9EC18C91C9327F11C384A0AA1EB12D7EFE85C4D53CA3C2A6C347C0068A4CE92A3138EB17232B0DEC88D52465C5DEDEEE6827
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Gambier)]} {.. LoadTimeZoneFile Pacific/Gambier..}..set TZData(:SystemV/YST9) $TZData(:Pacific/Gambier)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\SystemV\YST9YDT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):198
                                                                          Entropy (8bit):4.994125896811442
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSNJB9vsM3y7/9EtDSHAIgp/9Ef6N/kB490/9E9v:JByMY/947p/9XtN90/9s
                                                                          MD5:560B18DFB138DAF821CFDAE017B94473
                                                                          SHA1:0BB0312C742CC0097DF033656AE3D10723035C30
                                                                          SHA-256:DA20018DE301F879E4F026405C69FA0370EB10184FE1C84A4F1504079D5DAFA1
                                                                          SHA-512:B1D4EAD5F549E319DAD55EE67DAFD732E755164748C08633AA8F07C280B2CF617380D6F886304142D0E4D50026E63678DACFBE2DC809F780BA4CFF35A90DE906
                                                                          Malicious:false
                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Anchorage)]} {.. LoadTimeZoneFile America/Anchorage..}..set TZData(:SystemV/YST9YDT) $TZData(:America/Anchorage)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Turkey

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):180
                                                                          Entropy (8bit):4.9295990493611495
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/jCl1yQaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/SymKv
                                                                          MD5:1FABF2DFD4BFD0184AE22ED76F7569E5
                                                                          SHA1:5859266B26357B4FCADD7EC65847667631E303EB
                                                                          SHA-256:8471A5575B9D9E47412D851A18A26C4405480540AABC8DAED5F81BE0C714C07C
                                                                          SHA-512:1DCBECEF6D1F923E6C9CEA70CB10F1FF4E453265966AA88FBC8739E93EF40F8A16AAD85AF4ECC5CC1E52F22F49E5D3F4EE01A97DE2302FC4FBC063FE814F3851
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Turkey) $TZData(:Europe/Istanbul)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\UCT

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):153
                                                                          Entropy (8bit):4.844017562912325
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iGMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/iP8RX
                                                                          MD5:DA060D2F397C978E0842631B4EC73376
                                                                          SHA1:649BC85430B04662BE079C0AAD43DF5D5D499D28
                                                                          SHA-256:356A9BB6F831971C295CF4DCE0F0CDC9EDF94FD686CA3D3195E5F031A0B67CBA
                                                                          SHA-512:3359BFC6F0837D2DA9D72DA8053773CE0C1A1B1A47C33163BF38965E2104F57BC147F9EEC228A3591B75BF1BA93285AB83E8427E8E2E697AB18501DC017B6E6A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:UCT) $TZData(:Etc/UTC)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Alaska

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):189
                                                                          Entropy (8bit):4.911775112130145
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/VXEtDovXHAIg20/VXEfovRL/iOGl0IAcGE/VXEN:SlSWB9vsM3y7/9EtDSHAIgp/9Ef6N/i4
                                                                          MD5:4379C0BF618649AA07CC4BDAC75F62EF
                                                                          SHA1:7813B54BF2BD0C40A39CA9A29CC50C6D034880A3
                                                                          SHA-256:CED56F09D68BE00555219594C7B2F3E7EFE8323201FB3E2AA0E1FA9A6467D5AF
                                                                          SHA-512:AC822061F5C9743120A66E11C02B199253A40460A87F78DC154B0BDD91E410EDDA581E889F5D2A74670939034F39A7F6C7E814E038A1371DAB71EF79A8911AE7
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Anchorage)]} {.. LoadTimeZoneFile America/Anchorage..}..set TZData(:US/Alaska) $TZData(:America/Anchorage)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Aleutian

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):176
                                                                          Entropy (8bit):4.8886795125313585
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/yO5WXHAIg20/yOoNvWARL/iObMEIB/4IAcGE/y2:SlSWB9vsM3y7/yrHAIgp/yH0AN/itE8h
                                                                          MD5:AB14CF1840CBDA2B326660DBD51273B4
                                                                          SHA1:78144B3A2C75568307E4E86AE3B01EA7F541B011
                                                                          SHA-256:A4F1398CF84D0AE09BF19288770756622D1710CCBFBFE79E0D3239497731287D
                                                                          SHA-512:557A3ED9D1401E76291DC41524A1FD04AFF0829CEF66E103CEF9D10CD751F04FDEB6B7C0490302C71297F53AA8DC42930649AD274215D5DF068BCDE837E73756
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Adak)]} {.. LoadTimeZoneFile America/Adak..}..set TZData(:US/Aleutian) $TZData(:America/Adak)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Arizona

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.9334626069754455
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/iQMfQfBx+IAcGEB:SlSWB9vsM3y7OBHAIgpONYyHN/iZfQfl
                                                                          MD5:30ED80335BE37C7CBA672C33FDE23490
                                                                          SHA1:B627E86F023FE02A5590FE8D55FF41946BE6D24B
                                                                          SHA-256:9503403F231BA33415A5F2F0FDD3771CE7FF78534CE83C16A8DB5BC333B4AD8A
                                                                          SHA-512:C1352612EC0B4FF2F6F279CDB6008D7E9DA7F94F0009EFD959AD3092393150ECA83A09E72C724E1A4BFC3A057B9218D54A87FFA1102E2D9BF058B78AC0A0B1AB
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:US/Arizona) $TZData(:America/Phoenix)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Central

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):184
                                                                          Entropy (8bit):4.90255068822036
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx096yXHAIg20961yHRL/ibXgox/h4IAcGE967:SlSWB9vsM3y796SHAIgp9616N/iB490+
                                                                          MD5:7770A6B85B2FE73BCCE9D803E0200F23
                                                                          SHA1:784AD1082FF1569961C2AC44F6D6F7605FBBE766
                                                                          SHA-256:B6AC9FAE0AB69D58ECFD6B9A84F3C6D3E1A594E40CEEC94E2A0A7855781E173A
                                                                          SHA-512:EEE79D37D77E6B80B91E8F30CE48B107371F6A58F0C91785E3C74EF210AE1011D0EB913113F1873BE6099B0BE1260410F0C74650446CB377F8FDB5505A44F266
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Chicago)]} {.. LoadTimeZoneFile America/Chicago..}..set TZData(:US/Central) $TZData(:America/Chicago)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\East-Indiana

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):228
                                                                          Entropy (8bit):4.7645631776966715
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/i3E0903GK8:MByMY3GK7Kp3GKnti3t903GK8
                                                                          MD5:96828B6BA17CA96723794F4B3744B494
                                                                          SHA1:C3A824A925AEFE2A13A0E65548078D9842C2C7D7
                                                                          SHA-256:5D86F8D36598516FB2342A18A87DB2701BABD265B0671CC9321C48DB22C7ECA5
                                                                          SHA-512:2A27A455787DEAC3EC78A2784FB989DAB178E9D6DD7721CD3F5D3337231A3C651994B964D6CE040B7858E0127D7F70C0C48CB0D553D5B725B649C828288224B5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:US/East-Indiana) $TZData(:America/Indiana/Indianapolis)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Eastern

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):187
                                                                          Entropy (8bit):5.0345860115708785
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wAy0vfXHAIg20wAyGWARL/i37oxp4IAcGEwAy0yn:SlSWB9vsM3y71RHAIgp1aAN/i37oxp4P
                                                                          MD5:375DB249106C5D351CA0E84848835EDB
                                                                          SHA1:ECC5C0C9DA68773B94C9013F4F1A8800D511CC4C
                                                                          SHA-256:2FFCAD8CBEF5ECDC74DB3EE773E4B18ABC8EFA9C09C4EA8F3A45A08BADAF91A9
                                                                          SHA-512:21550743BF4E1A79754F76AB201F0EB6BA6B265F43855901640054316A4A32A5D01D266B2441E4A6415720715A2ABD367D82E3D40949A7A66BE9F8366E47A8DD
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/New_York)]} {.. LoadTimeZoneFile America/New_York..}..set TZData(:US/Eastern) $TZData(:America/New_York)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Hawaii

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):186
                                                                          Entropy (8bit):4.88075715646936
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG2fWGYFeyXHAIgObT2fWKARL/ioMN75nUDH2fWWv:SlSWB9vsM3yc6e8SHAIgOb6eKAN/ioER
                                                                          MD5:C0475756CFEC302F737967468804846E
                                                                          SHA1:85C13CA0A908C69B8BBB6040FC502AFF96B8F8C7
                                                                          SHA-256:529BB43EFDA6C1584FEAEA789B590CEF1397E33457AB3845F3101B1FC126E0FB
                                                                          SHA-512:D3FF374443344E8438D50803872E8A8EA077B2299B38C1BD155386B4D2C6008BBD0C0B0B26DE9680812D4AFC9A187B644BDCCB04C23880337228BCEC06D5D61B
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:US/Hawaii) $TZData(:Pacific/Honolulu)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Indiana-Starke

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):206
                                                                          Entropy (8bit):4.87340978435866
                                                                          Encrypted:false
                                                                          SSDEEP:6:SlSWB9vsM3y73GKaHAIgp3GKIN/iGIfh4903GKT:MByMY3GKDp3GKItiBfh4903GKT
                                                                          MD5:00AAFD60A0B1146274981FAB6336AFD9
                                                                          SHA1:20AD47ED52874202585C90FE362663F060E064D3
                                                                          SHA-256:5827B6A6D50CF0FB75D6BA6E36282591AD25E1F0BE636DCFC5D09BDA29A107FD
                                                                          SHA-512:61113AB72B7D671D7B429106709E73DB57D5B8A382680BA37A54126C7F54BC2D6B47A2584177CE6B434793546DA7EB9B8B7DF9163816DBFC67C83D9930D6A158
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Knox)]} {.. LoadTimeZoneFile America/Indiana/Knox..}..set TZData(:US/Indiana-Starke) $TZData(:America/Indiana/Knox)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Michigan

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):185
                                                                          Entropy (8bit):4.83459089067994
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06FQGFfXHAIg206FQJARL/iHaMCELMr4IAcGE6FQB:SlSWB9vsM3y74PFPHAIgp4KAN/iHaMHs
                                                                          MD5:D955A5A943B203DC4B87A91ED196B82A
                                                                          SHA1:C7ACC48AB2033C372C60C741F68B12FFAEA147DE
                                                                          SHA-256:B4E4269C4FEBFEFF26750B297A590226C0A6872519A6BFDE36F6DC3F6F756349
                                                                          SHA-512:445DC9A50487A4BA0A7F79078441696DCAA31F9988E5B515B5A827AC9275776B22DE303040900C1726EB99CABA8AD09E57AA674F798EA3FDEBC580E4B87D9439
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Detroit)]} {.. LoadTimeZoneFile America/Detroit..}..set TZData(:US/Michigan) $TZData(:America/Detroit)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Mountain

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):182
                                                                          Entropy (8bit):4.892777905787396
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/iBOlLo/4IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/iBY8/49Z
                                                                          MD5:E53EDD55E6448C624DD03A8A100EF5AF
                                                                          SHA1:1D266553CAFA23A3375CFAF7AFE6636553CC7B70
                                                                          SHA-256:3763BF520D3C97148C34DCFBDF70DEC2636D4E38241555900C058EFEE3BD1256
                                                                          SHA-512:B7FCF01DBB4231F30FEFA77C339B2CD7D984D6E6182F3BD15D6B64AC9525994E7CBF90C3F1F520FD22B54E19831B3CBAE1C22F04F60244C0C60A1809942422A4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:US/Mountain) $TZData(:America/Denver)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Pacific

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):196
                                                                          Entropy (8bit):4.932311644026309
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0ydJg4o3vXHAIg20ydJPyHRL/iP+e2IAcGEydJgov:SlSWB9vsM3y7DvPHAIgp5N/ip290Dy
                                                                          MD5:37AF94FAB52D80AF32C766644892E36D
                                                                          SHA1:03CE96A3B3EBFC16C9ED192DD2127FB265A7ED49
                                                                          SHA-256:54E5F126D4E7CC13555841A61FF66C0350621C089F475638A393930B3FB4918C
                                                                          SHA-512:405A7F414FA0864111E5E9F06FCA675BF4EF11FE0F82F5438416273BEF820A030A50E4D43E4E522ED79C08C0C243E9DD3692971DC912C9ADFB1BEABEB935CDDC
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:US/Pacific) $TZData(:America/Los_Angeles)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Pacific-New

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):200
                                                                          Entropy (8bit):4.977247045064076
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0ydJg4o3vXHAIg20ydJPyHRL/iP+yoQIAcGEydJgy:SlSWB9vsM3y7DvPHAIgp5N/i0Q90Dy
                                                                          MD5:870946B6C9C7C48EDDFDC7FEA5A303F5
                                                                          SHA1:F4E86423BD0EDFFD07B69B6D8834E28890A433BF
                                                                          SHA-256:B14C515D5823E7F6E4C67892FA376D54DB748FAB139C4D40DB50F22D113BAE4F
                                                                          SHA-512:36071FA97BD1052FB0425FDA7239F55728B3A6ACDF78A7A8F92D080DA25C0DF432F6C2B0CE9BD296B0C814451C5D7922E1318B004D9089E934B9C81B5E6077D6
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:US/Pacific-New) $TZData(:America/Los_Angeles)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\US\Samoa

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):188
                                                                          Entropy (8bit):4.838968615416201
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/i6A5nUDHurKeTyn:SlSWB9vsM3yciemHAIgObiecN/idXevn
                                                                          MD5:509CF35F5F7C9567FD19CC5C137DC070
                                                                          SHA1:AA5F27D36BC617A6A4107E3CA0CB0C10A71A1D9E
                                                                          SHA-256:E51FC51C65FFEAB514D7636271157EE8941BDACF602CBC380F5D60B5FA674E87
                                                                          SHA-512:E23633A16F11015F3FE2F4E675B5A60B4FDC61F8CF152FDB9BA7ED4C213B8897117721A78C5470296DAFB0FD4F0DDC019DD0DB8C28C1F1B2BE0D3A289F53D5B3
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:US/Samoa) $TZData(:Pacific/Pago_Pago)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\UTC

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):153
                                                                          Entropy (8bit):4.844017562912325
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iLB5h8RFB:SlSWB9vsM3yzTHAIgm6N/iLfh8RX
                                                                          MD5:3402C8784654C24F7E956731866B833F
                                                                          SHA1:C34F3CCA074A50E6564B8C78683C8763B37A3002
                                                                          SHA-256:DEE28FF84E3FC495ED3547D5E5E9FAFDACC36A67329E747D434248ED45BF1755
                                                                          SHA-512:FBA2840B0FA0F084EE9840BCF56E497F8A7ABF509FA10FA66FB26BA3D80079C4F9A363577A453CD68557080EAF9DD7F1F7B5AF957B64BDA2A897B1E08C85DD19
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:UTC) $TZData(:Etc/UTC)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Universal

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):159
                                                                          Entropy (8bit):4.879221007428352
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iL7DJMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/iL7VMr8RX
                                                                          MD5:5F24A249884C241D1E03D758C2641675
                                                                          SHA1:63AAC15A68659006F8A14FEC3F2A66B55A8AC398
                                                                          SHA-256:B7B0B82F471D64704E1D6F84646E6B7B2BD9CAB793FAD00F9C9B0595143C0AB7
                                                                          SHA-512:A7AB5E26A2C23BA296942D7C524C6EE6708A9A38CDD88022EA92E2180BC3CCFE930758FC20A24A0D271AD70733EB924B0E530FBF83CC0FC49EAD411B28503CC0
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Universal) $TZData(:Etc/UTC)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\W-SU

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):172
                                                                          Entropy (8bit):4.999171213761279
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVwTwWXHAIgoqzTbNOARL/gIuyQauTgvn:SlSWB9vsM3ymSHAIgoXAN/gXy5n
                                                                          MD5:5444E85070CA2E7A52D38D6D53216B88
                                                                          SHA1:0F9A4FB1156312EBD0B9C81DA2164E89D21878E1
                                                                          SHA-256:F7DA75B585F45AB501B2889E272FF47B1C4A1D668E40AED7463EB0E8054028C2
                                                                          SHA-512:BBC94F98C84641392D3A4B67C152E92EDB3011DA329319ADB2485DBEAFD44DED328D80FBCA89E58687E1F0EB6BED8580BBB0075CA42284B6206A8641D76F2DE5
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Moscow)]} {.. LoadTimeZoneFile Europe/Moscow..}..set TZData(:W-SU) $TZData(:Europe/Moscow)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\WET

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6945
                                                                          Entropy (8bit):3.7806395604065135
                                                                          Encrypted:false
                                                                          SSDEEP:96:v6PgDGfXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:rQbkIaFF1w0us4qE3+sSGjT
                                                                          MD5:1EC38B05B53ECF2DD3A90164C4693934
                                                                          SHA1:00900F0ADDB7526C63C67CA1662C038E95A79245
                                                                          SHA-256:7E6E2369C19DD19A41BE27BB8AD8DF5BE8B0096ED045C8B2C2D2F0916D494079
                                                                          SHA-512:47A8DAAB1B891FF09A94AF01B6673213392F70C6C1EE53D95A59D6E238FD06B0E80FA21C7279A9ADA891F5CA5B86E4D6B696EE8CFE14BFEF0ACCC9759AF1419A
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:WET) {.. {-9223372036854775808 0 0 WET}.. {228877200 3600 1 WEST}.. {243997200 0 0 WET}.. {260326800 3600 1 WEST}.. {276051600 0 0 WET}.. {291776400 3600 1 WEST}.. {307501200 0 0 WET}.. {323830800 3600 1 WEST}.. {338950800 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\tzdata\Zulu

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):154
                                                                          Entropy (8bit):4.8800842076244715
                                                                          Encrypted:false
                                                                          SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/taFBURFB:SlSWB9vsM3yzTHAIgm6N/YFaRX
                                                                          MD5:DDB6F69CA4F0EF6A708481F53F95EAB9
                                                                          SHA1:A63E900A9257E9D73B4BB4BACBA8133C3D1DC41B
                                                                          SHA-256:A06E8CCCF97CC8FB545DFDB4C89B5E5C8EDF0360547BDC1823B4AC47B1556C31
                                                                          SHA-512:C8EA1039BE001F5EF52662B28DBF46D02E4848F08F05923850DEA1994732037B4C8D6030B742D97FA4276AF5FEE3F17C47C7DDA4F44DD23244F9976A076D5CC4
                                                                          Malicious:false
                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Zulu) $TZData(:Etc/UTC)..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tcl\word.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5030
                                                                          Entropy (8bit):4.838527643033185
                                                                          Encrypted:false
                                                                          SSDEEP:96:HgTQWiZuhdFQJmuldFQofsGP3R1hF9Dl19arB0E9Dl1YoaEhHe2Gu/q1ZFyJRpqk:8iZUroxvR197ABr971h5GIqrmbqIc+b/
                                                                          MD5:70450A0CF04EF273EFF2B070053FCFA6
                                                                          SHA1:47974D6C0FC986EE1273C4E13DDB9E1288CEF0FF
                                                                          SHA-256:678F891615E2209A8ECBA17857922A9723E78709ADB983032E89CA706000C44D
                                                                          SHA-512:AFD3E47324D1497CC46AC6141191FCEB843977D0B0285C807FF8985DCC56FDE10977F57D503D986CD2C1EDC6C62F01E405A0EB483340B247B129FC8D6D9FE689
                                                                          Malicious:false
                                                                          Preview:# word.tcl --..#..# This file defines various procedures for computing word boundaries in..# strings. This file is primarily needed so Tk text and entry widgets behave..# properly for different platforms...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998 Scritpics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# The following variables are used to determine which characters are..# interpreted as white space.....if {$::tcl_platform(platform) eq "windows"} {.. # Windows style - any but a unicode space char.. if {![info exists ::tcl_wordchars]} {...set ::tcl_wordchars {\S}.. }.. if {![info exists ::tcl_nonwordchars]} {...set ::tcl_nonwordchars {\s}.. }..} else {.. # Motif style - any unicode word char (number, letter, or underscore).. if {![info exists ::tcl_wordchars]} {...set ::tcl_wordchars {\w}.. }.. if {![info exists ::tcl_nonwordchar

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk86t.dll

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1542552
                                                                          Entropy (8bit):6.177696167346554
                                                                          Encrypted:false
                                                                          SSDEEP:24576:q1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58aVJkwd98ydeyRP/oAT:qIyQD9FU43GLUKuPO6EinYTVAFSvESaN
                                                                          MD5:499FA3DEA045AF56EE5356C0CE7D6CE2
                                                                          SHA1:0444B7D4ECD25491245824C17B84916EE5B39F74
                                                                          SHA-256:20139F4C327711BAF18289584FA0C8112F7BB3BA55475BDED21F3D107672ED94
                                                                          SHA-512:D776749EFFA241BA1415B28D2FCFF1D64ED903569A8C4E56DFDDD672A53B2F44119734B1959B72A9B3F4060BB2C67B7DEA959CC2D4A8E9F781F17009C6840FC1
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A...f...f...f..W....f..W....f..W....f..W....f.......f......f....&..f.......f...f..Lg.....f......f...J..f......f..Rich.f..........PE..d......b.........." .........~......|...............................................q.....`.............................................L@...[..|........{... .......j.......`...A...-...............................-..8...............8............................text...X........................... ..`.rdata...l.......n..................@..@.data................j..............@....pdata....... ......................@..@.rsrc....{.......|..................@..@.reloc...A...`...B...(..............@..B........................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\bgerror.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8806
                                                                          Entropy (8bit):4.863085192885279
                                                                          Encrypted:false
                                                                          SSDEEP:192:RpwYLapGk1BlM4UBIHpJFVUXUziMJ5Kxyk55qxUr7Vdk5vNR:RuYfvMdOXyj+01f
                                                                          MD5:C5E9A2E32AE83A79DF422D1145B692DF
                                                                          SHA1:08350F930FB97A95970122920C91FB9CED8329E9
                                                                          SHA-256:8822365EE279BEBF7A36CFDEDBA1114762F894781F4635170CC5D85FF5B17923
                                                                          SHA-512:71420E15A3D63329560074F6FFAD42CB464401284BC29D0DC8E34D83F8F77079F26BB4C5703E656A48E6931C3DBF6B873756FB212D0860483E0301B29EDE1212
                                                                          Malicious:false
                                                                          Preview:# bgerror.tcl --..#..#.Implementation of the bgerror procedure. It posts a dialog box with..#.the error message and gives the user a chance to see a more detailed..#.stack trace, and possible do something more interesting with that..#.trace (like save it to a log). This is adapted from work done by..#.Donal K. Fellows...#..# Copyright (c) 1998-2000 by Ajuba Solutions...# Copyright (c) 2007 by ActiveState Software Inc...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>....namespace eval ::tk::dialog::error {.. namespace import -force ::tk::msgcat::*.. namespace export bgerror.. option add *ErrorDialog.function.text [mc "Save To Log"] \...widgetDefault.. option add *ErrorDialog.function.command [namespace code SaveToLog].. option add *ErrorDialog*Label.font TkCaptionFont widgetDefault.. if {[tk windowingsystem] eq "aqua"} {...option add *ErrorDialog*background systemAlertBackgroundActi

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\button.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):21612
                                                                          Entropy (8bit):4.947590677310969
                                                                          Encrypted:false
                                                                          SSDEEP:384:Tv7cBCAsj9oqlFFSsB3VfRt+lMpWaNwJgzCHarc6gAsj9oqlFFSsB3VlRtYlMpBz:TvweHBBTfIZxHBnZWqbJPBFIaVlCj26+
                                                                          MD5:AEB53F7F1506CDFDFE557F54A76060CE
                                                                          SHA1:EBB3666EE444B91A0D335DA19C8333F73B71933B
                                                                          SHA-256:1F5DD8D81B26F16E772E92FD2A22ACCB785004D0ED3447E54F87005D9C6A07A5
                                                                          SHA-512:ACDAD4DF988DF6B2290FC9622E8EACCC31787FECDC98DCCA38519CB762339D4D3FB344AE504B8C7918D6F414F4AD05D15E828DF7F7F68F363BEC54B11C9B7C43
                                                                          Malicious:false
                                                                          Preview:# button.tcl --..#..# This file defines the default bindings for Tk label, button,..# checkbutton, and radiobutton widgets and provides procedures..# that help in implementing those bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 2002 ActiveState Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for buttons...#-------------------------------------------------------------------------....if {[tk windowingsystem] eq "aqua"} {.... bind Radiobutton <Enter> {...tk::ButtonEnter %W.. }.. bind Radiobutton <1> {...tk::ButtonDown %W.. }.. bind Radiobutton <ButtonRelease-1> {...tk::ButtonUp %W.. }.. bind Checkbutton <Enter> {...tk::ButtonEnter %W

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\choosedir.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9960
                                                                          Entropy (8bit):4.802555950168837
                                                                          Encrypted:false
                                                                          SSDEEP:192:HKOdkMpU9YUp8UIhMYYicln9Die0luVZat3pIp5Y3sF1P8Bg8p6trIOzvKsOiCLU:HyMm9J8wPx70luex4C8Fygq6tohef+0J
                                                                          MD5:818E4F0112931F12B4FAC4CAD262814C
                                                                          SHA1:AC7060DF952F9DB52C3687B8F5E6AA4ADF06992E
                                                                          SHA-256:35B208E8570B0D1E0CA1C911D4FE02EE3B0CFE5667CF1BDEC006CF9D043122BA
                                                                          SHA-512:0C535B6621BC83412B7A64CB6AC2BA526B8E49BB5F6BC5EBEDA41D223D68DEB031DB9C8A31F8671BC5F327D720942E7FDAE3328334B0B550AC991191F96909D6
                                                                          Malicious:false
                                                                          Preview:# choosedir.tcl --..#..#.Choose directory dialog implementation for Unix/Mac...#..# Copyright (c) 1998-2000 by Scriptics Corporation...# All rights reserved.....# Make sure the tk::dialog namespace, in which all dialogs should live, exists..namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}....# Make the chooseDir namespace inside the dialog namespace..namespace eval ::tk::dialog::file::chooseDir {.. namespace import -force ::tk::msgcat::*..}....# ::tk::dialog::file::chooseDir:: --..#..#.Implements the TK directory selection dialog...#..# Arguments:..#.args..Options parsed by the procedure...#..proc ::tk::dialog::file::chooseDir:: {args} {.. variable ::tk::Priv.. set dataName __tk_choosedir.. upvar ::tk::dialog::file::$dataName data.. Config $dataName $args.... if {$data(-parent) eq "."} {.. set w .$dataName.. } else {.. set w $data(-parent).$dataName.. }.... # (re)create the dialog box if necessary.. #.. if {![winfo exis

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\clrpick.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):22112
                                                                          Entropy (8bit):5.032169196169179
                                                                          Encrypted:false
                                                                          SSDEEP:384:lJGidpe3JQDUd6hgp6EQstzQf+a9DPbJ43/H//cO802UeeVnZmM6BA0kyVJv9Qpu:Gep6JCwQDPbWPaRCzTdMAe
                                                                          MD5:89C6CABEB68B1A5318D88DD8444C3DE3
                                                                          SHA1:C19C58EEC7FB5105A609C0896EDCC336C00E7F9E
                                                                          SHA-256:E7AA73828A731DCC9541308AA53FF3CF550A0952FD42C4D86D831F87FB47CDCF
                                                                          SHA-512:A49A96A2BFC0D1A8E4003526E7836B9968DAF2B4DA727B23B7E180B5472DD187AB409D2FDF233F2557BD0DC2B4FE57AA2DD57BC2BDCE90DD2B603F4BB74CF22D
                                                                          Malicious:false
                                                                          Preview:# clrpick.tcl --..#..#.Color selection dialog for platforms that do not support a..#.standard color selection dialog...#..# Copyright (c) 1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#..# ToDo:..#..#.(1): Find out how many free colors are left in the colormap and..#. don't allocate too many colors...#.(2): Implement HSV color selection...#....# Make sure namespaces exist..namespace eval ::tk {}..namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::color {.. namespace import ::tk::msgcat::*..}....# ::tk::dialog::color:: --..#..#.Create a color dialog and let the user choose a color. This function..#.should not be called directly. It is called by the tk_chooseColor..#.function when a native color selector widget does not exist..#..proc ::tk::dialog::color:: {args} {.. variable ::tk::Priv.. set dataName __tk__color.. upvar ::tk::dialog::color::$da

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\comdlg.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8690
                                                                          Entropy (8bit):5.098389551322902
                                                                          Encrypted:false
                                                                          SSDEEP:192:u4R7+/gFw/MEN55fO7eyjt4bjC+gR8e3vwLln/+LVtUw0tXK4jA:u4l+/gFeMI55Xyjt4bjC+gOe3Ih/+LV1
                                                                          MD5:ABF277E4F62423F4345B6AD65640B8C2
                                                                          SHA1:E66A4E37D51C7827C9ACA449A42E0966AACBC8C8
                                                                          SHA-256:C7DA292CCF5F413E599C3491C331FFD58CF273F8477FACB097E6F36CF1F32A08
                                                                          SHA-512:AA9F75D7C5C915B5FCD2F454856D080D186AB9BA149DC139FEAF7F4AC3DC51E6769E138E3B1BE45B3FEC3AE744189DE44DB2B748F0628FF13E4E733B9CD68BD5
                                                                          Malicious:false
                                                                          Preview:# comdlg.tcl --..#..#.Some functions needed for the common dialog boxes. Probably need to go..#.in a different file...#..# Copyright (c) 1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# tclParseConfigSpec --..#..#.Parses a list of "-option value" pairs. If all options and..#.values are legal, the values are stored in..#.$data($option). Otherwise an error message is returned. When..#.an error happens, the data() array may have been partially..#.modified, but all the modified members of the data(0 array are..#.guaranteed to have valid values. This is different than..#.Tk_ConfigureWidget() which does not modify the value of a..#.widget record if any error occurs...#..# Arguments:..#..# w = widget record to modify. Must be the pathname of a widget...#..# specs = {..# {-commandlineswitch resourceName ResourceClass defaultValue verifier}..# {....}..# }..#..# flags

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\console.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):33942
                                                                          Entropy (8bit):4.953820376776617
                                                                          Encrypted:false
                                                                          SSDEEP:384:jMpwGUC0zCLemVueuR3fS8X4rqU9ykVBjG+FUHyOnmTTRV+po2mBh6S5mDjbHqzG:jMpdUFzCLpCrI3vVBhjnD2jVfV/
                                                                          MD5:B927A17A86D5E43606C93CC6F90A5A4A
                                                                          SHA1:03C1005EA8FABA9055591D095674D85F64E5C154
                                                                          SHA-256:9D023DBF3B0FCD25E13502B34F8BE63F64DA592FA612EBD31C08AF4AC27338D6
                                                                          SHA-512:B4443C72A28A172B0E113089085EC5D663A84384EB31B56BE23E507B285065E8D8EAB4A1306352A01843C13D1B5B15FF05D7956B89BCF693363D68C5B8B48864
                                                                          Malicious:false
                                                                          Preview:# console.tcl --..#..# This code constructs the console window for an application. It..# can be used by non-unix systems that do not have built-in support..# for shells...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...# Copyright (c) 2007-2008 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# TODO: history - remember partially written command....namespace eval ::tk::console {.. variable blinkTime 500 ; # msecs to blink braced range for.. variable blinkRange 1 ; # enable blinking of the entire braced range.. variable magicKeys 1 ; # enable brace matching and proc/var recognition.. variable maxLines 600 ; # maximum # of lines buffered in console.. variable showMatches 1 ; # show multiple expand matches.. variable useFontchooser [llength [info command ::tk::fontchooser]

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\dialog.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5988
                                                                          Entropy (8bit):4.829498876074983
                                                                          Encrypted:false
                                                                          SSDEEP:96:qFR55woFFEciKwKClFEOTIhDHWyzaoj9zza7v0J7:qL55jiKwKCzTIhDbzaojhSG7
                                                                          MD5:B2B3AA971D42FDBF92F13B45111EE1D3
                                                                          SHA1:A74F2C2707463D6E209D0E0C96D75083AC6920A5
                                                                          SHA-256:1C977052C1D8293CC5FE4198A538BECA9BC821AF85E76E4EEFBFB75B33CE8BED
                                                                          SHA-512:146F658DA3E6E9176FA51C9836D7C1DCFC14E148A26B224155F6493C195A7FB20C2DC4EE21994E5A193B8DA8561C75374E830304F94F0C844E52AD829F6810D5
                                                                          Malicious:false
                                                                          Preview:# dialog.tcl --..#..# This file defines the procedure tk_dialog, which creates a dialog..# box containing a bitmap, a message, and one or more buttons...#..# Copyright (c) 1992-1993 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#..# ::tk_dialog:..#..# This procedure displays a dialog box, waits for a button in the dialog..# to be invoked, then returns the index of the selected button. If the..# dialog somehow gets destroyed, -1 is returned...#..# Arguments:..# w -..Window to use for dialog top-level...# title -.Title to display in dialog's decorative frame...# text -.Message to display in dialog...# bitmap -.Bitmap to display in dialog (empty string means none)...# default -.Index of button that is to display the default ring..#..(-1 means none)...# args -.One or more strings to display in buttons

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\entry.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):18401
                                                                          Entropy (8bit):4.982139840696722
                                                                          Encrypted:false
                                                                          SSDEEP:384:mDfyRIlBk3yrt8qLjtpa+qh+rA4rsWRWrrMUtCPnkKYNlPp64ZnCD:mDfyRIlBk3yJ8mtpaplcp6o
                                                                          MD5:F109865C52D1FD602E2D53E559E56C22
                                                                          SHA1:5884A3BB701C27BA1BF35C6ADD7852E84D73D81F
                                                                          SHA-256:AF1DE90270693273B52FC735DA6B5CD5CA794F5AFD4CF03FFD95147161098048
                                                                          SHA-512:B2F92B0AC03351CDB785D3F7EF107B61252398540B5F05F0CC9802B4D28B882BA6795601A68E88D3ABC53F216B38F07FCC03660AB6404CF6685F6D80CC4357FC
                                                                          Malicious:false
                                                                          Preview:# entry.tcl --..#..# This file defines the default bindings for Tk entry widgets and provides..# procedures that help in implementing those bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#...start dragging out a selection)...# pressX -..X-coordinate at which the mouse button was pressed...# selectMode -..The style of selection currently underway:..#...char, word

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\focus.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5035
                                                                          Entropy (8bit):4.819523401259934
                                                                          Encrypted:false
                                                                          SSDEEP:96:J3MRZZ7HWb/6OgRKjtS6Mn9GRZZ7HWb2Y6aO6R5nh76SMoB2kd82KtTpsi2D0DSn:CRZdPul1RZdFaRf0XoB2gZKZpsi2pn
                                                                          MD5:63B219BE9AFF1DE7DE2BAF0E941CAE38
                                                                          SHA1:A2FEBB31380E12FF01E6F641FE8B4F815941462F
                                                                          SHA-256:8872F236D7E824AEC0ACD4BACC00FDD7EC9BC5534814ECF2160610C10647B7C5
                                                                          SHA-512:057700F8FDE4B7C3D7AB7CEFD6C531060BF2B1B3B727CAD6A37ECD42EBC557765D94B83ADD438BD5AFA1F6F919D80AE755A8D98918981167B871F31AD42FDF5E
                                                                          Malicious:false
                                                                          Preview:# focus.tcl --..#..# This file defines several procedures for managing the input..# focus...#..# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_focusNext --..# This procedure returns the name of the next window after "w" in..# "focus order" (the window that should receive the focus next if..# Tab is typed in w). "Next" is defined by a pre-order search..# of a top-level and its non-top-level descendants, with the stacking..# order determining the order of siblings. The "-takefocus" options..# on windows determine whether or not they should be skipped...#..# Arguments:..# w -..Name of a window.....proc ::tk_focusNext w {.. set cur $w.. while {1} {.....# Descend to just before the first child of the current widget......set parent $cur...set children [winfo children $cur]...set i -1.....# Look for the next sibling that isn't a top-leve

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\fontchooser.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):16467
                                                                          Entropy (8bit):4.795270290870865
                                                                          Encrypted:false
                                                                          SSDEEP:384:aUcEQ2Mq56jP/oVR6EcW0i9cWHKVo8q5F2Zsb9M:aUcEQ2Mq56jP/oVR6Ec5i9hKSxFC
                                                                          MD5:A11F7D5F858E28D67F5391454401CAE8
                                                                          SHA1:8ACAE04BE25249A3B7524B2C4AC03BF9FCF081D7
                                                                          SHA-256:48C6D9EABB028A57291C009E1B02756D1EA6A18F9ACA7066C59BC3C5D881D3A6
                                                                          SHA-512:E8D9B11208642C62166C62AF605341EC7BEEF4E178DD3FCC9E72E4436BE1F4E5D1952B78C5FA206D85D61693922FE26ACAF9267725387F2A7A56EE2D95A6D69A
                                                                          Malicious:false
                                                                          Preview:# fontchooser.tcl -..#..#.A themeable Tk font selection dialog. See TIP #324...#..# Copyright (C) 2008 Keith Vetter..# Copyright (C) 2008 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::fontchooser {.. variable S.... set S(W) .__tk__fontchooser.. set S(fonts) [lsort -dictionary [font families]].. set S(styles) [list \...[::msgcat::mc "Regular"] \...[::msgcat::mc "Italic"] \...[::msgcat::mc "Bold"] \...[::msgcat::mc "Bold Italic"] \.. ].... set S(sizes) {8 9 10 11 12 14 16 18 20 22 24 26 28 36 48 72}.. set S(strike) 0.. set S(under) 0.. set S(first) 1.. set S(sampletext) [::msgcat::mc "AaBbYyZz01"].. set S(-parent) ... set S(-title) [::msgcat::mc "Font"].. set S(-command) "".. set S(-font) TkDefaultFont..}....proc ::tk::fontchooser::Setup {} {.. variable S.... # Canonical versions of f

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\iconlist.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):17421
                                                                          Entropy (8bit):4.954921304048498
                                                                          Encrypted:false
                                                                          SSDEEP:384:FNP8nO9Wo8k5NfQH8EsOy8WMVbcfNCvJshPOw7jW:FNf8uNfQH89Z8WMVY15DW
                                                                          MD5:4FDE770E3DFF8B95295FB887F510534B
                                                                          SHA1:5356BA885D61910A34756188D676FACD0353ED8A
                                                                          SHA-256:C8B4B2130C6AD658331C59F41D8BDBAB44E0011781214A0B0BE78C4920536B2E
                                                                          SHA-512:30BF50137F18643FC3622EAA195EC7E0F21B77980C16DB54CCA1B7AEFA17CA4CE8E6F82D6C8F4A0DFB6DD78D4F115D3A5D8DA7573A928AF9C1A92727BD4F0691
                                                                          Malicious:false
                                                                          Preview:# iconlist.tcl..#..#.Implements the icon-list megawidget used in the "Tk" standard file..#.selection dialog boxes...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...# Copyright (c) 2009 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#..# API Summary:..#.tk::IconList <path> ?<option> <value>? .....#.<path> add <imageName> <itemList>..#.<path> cget <option>..#.<path> configure ?<option>? ?<value>? .....#.<path> deleteall..#.<path> destroy..#.<path> get <itemIndex>..#.<path> index <index>..#.<path> invoke..#.<path> see <index>..#.<path> selection anchor ?<int>?..#.<path> selection clear <first> ?<last>?..#.<path> selection get..#.<path> selection includes <item>..#.<path> selection set <first> ?<last>?.....package require Tk....::tk::Megawidget create ::tk::IconList ::tk::FocusableWidget {.. variable w canvas sbar accel accelCB fill font index \...itemList itemsPerColumn list

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\icons.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):11037
                                                                          Entropy (8bit):6.048349526382653
                                                                          Encrypted:false
                                                                          SSDEEP:192:0nEPytJLl1S47T3YqN5/vkJpnhXqBB4aw2rqZiygTtYTpOq/pc75Mk:xqLz7F5KTqBBLuZ1gTSsqhk
                                                                          MD5:995A0A8F7D0861C268AEAD5FC95A42EA
                                                                          SHA1:21E121CF85E1C4984454237A646E58EC3C725A72
                                                                          SHA-256:1264940E62B9A37967925418E9D0DC0BEFD369E8C181B9BAB3D1607E3CC14B85
                                                                          SHA-512:DB7F5E0BC7D5C5F750E396E645F50A3E0CDE61C9E687ADD0A40D0C1AA304DDFBCEEB9F33AD201560C6E2B051F2EDED07B41C43D00F14EE435CDEEE73B56B93C7
                                                                          Malicious:false
                                                                          Preview:# icons.tcl --..#..#.A set of stock icons for use in Tk dialogs. The icons used here..#.were provided by the Tango Desktop project which provides a..#.unified set of high quality icons licensed under the..#.Creative Commons Attribution Share-Alike license..#.(https://creativecommons.org/licenses/by-sa/3.0/)..#..#.See http://tango.freedesktop.org/Tango_Desktop_Project..#..# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>....namespace eval ::tk::icons {}....image create photo ::tk::icons::warning -data {.. iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAABSZJREFU.. WIXll1toVEcYgL+Zc87u2Yu7MYmrWRuTJuvdiMuqiJd4yYKXgMQKVkSjFR80kFIVJfWCWlvpg4h9.. 8sXGWGof8iKNICYSo6JgkCBEJRG8ImYThNrNxmaTeM7pQ5IlJkabi0/9YZhhZv7///4z/8zPgf+7.. KCNRLgdlJijXwRyuDTlcxV9hbzv8nQmxMjg+XDtiOEplkG9PSfkztGmTgmFQd+FCVzwa3fYN/PHZ.. AcpBaReicW5xcbb64IEQqko8Lc26d/58cxS+/BY6hmJvyEfQBoUpwWCmW1FErKaGWHU13uRk4QkE.. UtxQNFR7QwIoB4eiKD9PWbVKbb10CZmaCqmpxCormRYO26QQx85B0mcD+AeK0

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\README

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):329
                                                                          Entropy (8bit):4.3973643486226655
                                                                          Encrypted:false
                                                                          SSDEEP:6:nVxpJFBmHdeA1xNZgk0dIf3Ju4dFi6/XWrWhr3W7FxmVFraazmVAJFKyVQR7icr8:nj5Bqf1fZgp6A4FDG6dm7FUGAJVVMRmn
                                                                          MD5:921245A21F7E783997DC7B859AF1B65B
                                                                          SHA1:2EFE3C8F70CF18621006890BF21CC097770D140D
                                                                          SHA-256:C6DB098EBD8A622164D37D4AB0A8C205DB1A83AC3065D5CDE3CB5FB61925D283
                                                                          SHA-512:CAD823FF3D13A64C00825961E75B5133690556FB1F622834F8B1DF316A9E75BABB63B9F5148DAE7B1391123B4C8D55B4B8B2EB6F8E6E1DA9DE02A5BD7AC0FD6F
                                                                          Malicious:false
                                                                          Preview:README - images directory....This directory includes images for the Tcl Logo and the Tcl Powered..Logo. Please feel free to use the Tcl Powered Logo on any of your..products that employ the use of Tcl or Tk. The Tcl logo may also be..used to promote Tcl in your product documentation, web site or other..places you so desire...

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\logo.eps

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):34991
                                                                          Entropy (8bit):5.248845410801251
                                                                          Encrypted:false
                                                                          SSDEEP:768:0YrY6a0v4uIqYMEKjodQKOfRXMLcSqDGpfTKFVm3AsanMEDzzBHWzaw7XUbTJjoB:0YrY6aeIqYMEKjouzfRXMLcSqDGpfTKo
                                                                          MD5:23C4EDED40DEC065F99E6653AEE1BB31
                                                                          SHA1:3175E261BE198731DEDB07264CCB84C8DEDF7967
                                                                          SHA-256:76207D8DFDE189A29DC0E76ADB7EAAA606B96BC6C1C831F34D1C85B1C5B51DD3
                                                                          SHA-512:BA139A64BE72BB681040924C4294E2726BA5AB243E805E60A854D2D23E154705E2431D1AB2DE732BFA393747FD30D8A5C913895CBE1463DBF50CC23CAE5B0454
                                                                          Malicious:false
                                                                          Preview:%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL/TK LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:58 PM)..%%BoundingBox: 251 331 371 512..%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%DocumentCustomColors: (TCL RED)..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe Illustrator

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\logo100.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2341
                                                                          Entropy (8bit):6.9734417899888665
                                                                          Encrypted:false
                                                                          SSDEEP:48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
                                                                          MD5:FF04B357B7AB0A8B573C10C6DA945D6A
                                                                          SHA1:BCB73D8AF2628463A1B955581999C77F09F805B8
                                                                          SHA-256:72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
                                                                          SHA-512:10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
                                                                          Malicious:false
                                                                          Preview:GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......*\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~*].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\logo64.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1670
                                                                          Entropy (8bit):6.326462043862671
                                                                          Encrypted:false
                                                                          SSDEEP:48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
                                                                          MD5:B226CC3DA70AAB2EBB8DFFD0C953933D
                                                                          SHA1:EA52219A37A140FD98AEA66EA54685DD8158D9B1
                                                                          SHA-256:138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
                                                                          SHA-512:3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
                                                                          Malicious:false
                                                                          Preview:GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\logoLarge.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):11000
                                                                          Entropy (8bit):7.88559092427108
                                                                          Encrypted:false
                                                                          SSDEEP:192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
                                                                          MD5:45D9B00C4CF82CC53723B00D876B5E7E
                                                                          SHA1:DDD10E798AF209EFCE022E97448E5EE11CEB5621
                                                                          SHA-256:0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
                                                                          SHA-512:6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
                                                                          Malicious:false
                                                                          Preview:GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......*\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.*^.x.....J.L.!.'........=+eZ..i..ynF.8...].y|..m.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\logoMed.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3889
                                                                          Entropy (8bit):7.425138719078912
                                                                          Encrypted:false
                                                                          SSDEEP:48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
                                                                          MD5:BD12B645A9B0036A9C24298CD7A81E5A
                                                                          SHA1:13488E4F28676F1E0CE383F80D13510F07198B99
                                                                          SHA-256:4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
                                                                          SHA-512:F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
                                                                          Malicious:false
                                                                          Preview:GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.*&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..*K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\pwrdLogo.eps

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):29706
                                                                          Entropy (8bit):5.33387357427899
                                                                          Encrypted:false
                                                                          SSDEEP:768:0warY6a0v4uIqYMEKjodQKOfRtMLcSqDGpf88KFVmlhEtOI/eE7U0a1:03rY6aeIqYMEKjouzfRtMLcSqDGpfbKc
                                                                          MD5:4AE11820D4D592D02CDE458E6F8CE518
                                                                          SHA1:A2E8D3D6191B336D43E48A65C3AE6485B07D93C6
                                                                          SHA-256:87FD9E46DBB5F2BF1529AFB411182C9FB9C58E23D830C66A233AF0C256BB8EFF
                                                                          SHA-512:E0AD4ED570D414BF00931B0F5BBB61FEF981ABDB22ECC42F8E9841905D38874CDFE38F22EDB17ACD0F7539B2932F9C4A865FA73A49BB1458CE05EE10A78BE357
                                                                          Malicious:false
                                                                          Preview:%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL PWRD LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:59 PM)..%%BoundingBox: 242 302 377 513..%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe I

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\pwrdLogo100.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1615
                                                                          Entropy (8bit):7.461273815456419
                                                                          Encrypted:false
                                                                          SSDEEP:48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
                                                                          MD5:DBFAE61191B9FADD4041F4637963D84F
                                                                          SHA1:BD971E71AE805C2C2E51DD544D006E92363B6C0C
                                                                          SHA-256:BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
                                                                          SHA-512:ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
                                                                          Malicious:false
                                                                          Preview:GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8O*Z.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.|..pf!..&.......8.#.8.....*..J>. .t..h6(........#..0.A...*!..)...x..u.Z....*%..H.....*.......`......|.....1.......&.....T*...f.l...

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\pwrdLogo150.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2489
                                                                          Entropy (8bit):7.708754027741608
                                                                          Encrypted:false
                                                                          SSDEEP:48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
                                                                          MD5:711F4E22670FC5798E4F84250C0D0EAA
                                                                          SHA1:1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
                                                                          SHA-256:5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
                                                                          SHA-512:220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
                                                                          Malicious:false
                                                                          Preview:GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\pwrdLogo175.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2981
                                                                          Entropy (8bit):7.758793907956808
                                                                          Encrypted:false
                                                                          SSDEEP:48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
                                                                          MD5:DA5FB10F4215E9A1F4B162257972F9F3
                                                                          SHA1:8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
                                                                          SHA-256:62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
                                                                          SHA-512:990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
                                                                          Malicious:false
                                                                          Preview:GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....*0p}..KP?c.\@KW.S(..M..B.....-q...S2...*.,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.*4..(........*..F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\pwrdLogo200.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3491
                                                                          Entropy (8bit):7.790611381196208
                                                                          Encrypted:false
                                                                          SSDEEP:96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
                                                                          MD5:A5E4284D75C457F7A33587E7CE0D1D99
                                                                          SHA1:FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
                                                                          SHA-256:BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
                                                                          SHA-512:4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
                                                                          Malicious:false
                                                                          Preview:GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R...*...J.p.A.t.*..$A*...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y1*35.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. ...*..Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'|..M9..."...,*.......

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\pwrdLogo75.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1171
                                                                          Entropy (8bit):7.289201491091023
                                                                          Encrypted:false
                                                                          SSDEEP:24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
                                                                          MD5:7013CFC23ED23BFF3BDA4952266FA7F4
                                                                          SHA1:E5B1DED49095332236439538ECD9DD0B1FD4934B
                                                                          SHA-256:462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
                                                                          SHA-512:A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
                                                                          Malicious:false
                                                                          Preview:GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N|...f..J.x... P&.|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\images\tai-ku.gif

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5473
                                                                          Entropy (8bit):7.754239979431754
                                                                          Encrypted:false
                                                                          SSDEEP:96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
                                                                          MD5:048AFE69735F6974D2CA7384B879820C
                                                                          SHA1:267A9520C4390221DCE50177E789A4EBD590F484
                                                                          SHA-256:E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
                                                                          SHA-512:201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
                                                                          Malicious:false
                                                                          Preview:GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa....*.p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......Ef*Y3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\license.terms

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2307
                                                                          Entropy (8bit):5.135743409565932
                                                                          Encrypted:false
                                                                          SSDEEP:48:XU/zAcKT6yOCaDBfsHLk32s3J5w83KDyP1BXy3JQz7yuC:XNc+92sg3A8uyDXy3JQnDC
                                                                          MD5:F090D9B312C16489289FD39813412164
                                                                          SHA1:1BEC6668F6549771DADC67D153B89B8F77DCD4B9
                                                                          SHA-256:0D1E4405F6273F091732764ED89B57066BE63CE64869BE6C71EA337DC4F2F9B5
                                                                          SHA-512:57B323589C5A8D9CBB224416731D8CE65C4B94146DF15CE30885DF63B1D0B3F709093B65390A911F84F20B7C5DE3C0AF9B4D7D531742BE046EDA6E8C3432EF6E
                                                                          Malicious:false
                                                                          Preview:This software is copyrighted by the Regents of the University of..California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState..Corporation, Apple Inc. and other parties. The following terms apply to..all files associated with the software unless explicitly disclaimed in..individual files.....The authors hereby grant permission to use, copy, modify, distribute,..and license this software and its documentation for any purpose, provided..that existing copyright notices are retained in all copies and that this..notice is included verbatim in any distributions. No written agreement,..license, or royalty fee is required for any of the authorized uses...Modifications to this software may be copyrighted by their authors..and need not follow the licensing terms described here, provided that..the new terms are clearly indicated on the first page of each file where..they apply.....IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY..FOR DIRECT, INDIRECT, SPECIAL, INCI

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\listbox.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):15255
                                                                          Entropy (8bit):4.9510475386072095
                                                                          Encrypted:false
                                                                          SSDEEP:384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
                                                                          MD5:804E6DCE549B2E541986C0CE9E75E2D1
                                                                          SHA1:C44EE09421F127CF7F4070A9508F22709D06D043
                                                                          SHA-256:47C75F9F8348BF8F2C086C57B97B73741218100CA38D10B8ABDF2051C95B9801
                                                                          SHA-512:029426C4F659848772E6BB1D8182EB03D2B43ADF68FCFCC1EA1C2CC7C883685DEDA3FFFDA7E071912B9BDA616AD7AF2E1CB48CE359700C1A22E1E53E81CAE34B
                                                                          Malicious:false
                                                                          Preview:# listbox.tcl --..#..# This file defines the default bindings for Tk listbox widgets..# and provides procedures that help in implementing those bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....#--------------------------------------------------------------------------..# tk::Priv elements used in this file:..#..# afterId -..Token returned by "after" for autoscanning...# listboxPrev -.The last element to be selected or deselected..#...during a selection operation...# listboxSelection -.All of the items that were selected before the..#...current selection operation (such as a mouse..#...drag) started; used to cancel an operation...#--------------------------------------------------------------------------....#--------------

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\megawidget.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9862
                                                                          Entropy (8bit):4.786615174847384
                                                                          Encrypted:false
                                                                          SSDEEP:192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
                                                                          MD5:D83ED6AC2912900040530528A0237AB3
                                                                          SHA1:2D18E42A8B96C3D71C1C6701010FDF75C1E6D5D8
                                                                          SHA-256:848258B946C002E2696CA3815A1589C8120AF5CC41FBC11BBD9A3F5754CC21AF
                                                                          SHA-512:00B4CD0D58029FC37820C163A4AE1DEAD22FB5C767BDC118659EACE26D449C362189611DFB3FAB1AC129FABFEC2CE853EA2C10D418FAE5AEB91DDC9330FF782D
                                                                          Malicious:false
                                                                          Preview:# megawidget.tcl..#..#.Basic megawidget support classes. Experimental for any use other than..#.the ::tk::IconList megawdget, which is itself only designed for use in..#.the Unix file dialogs...#..# Copyright (c) 2009-2010 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#....package require Tk.....::oo::class create ::tk::Megawidget {.. superclass ::oo::class.. method unknown {w args} {...if {[string match .* $w]} {... [self] create $w {*}$args... return $w...}...next $w {*}$args.. }.. unexport new unknown.. self method create {name superclasses body} {...next $name [list \....superclass ::tk::MegawidgetClass {*}$superclasses]\;$body.. }..}....::oo::class create ::tk::MegawidgetClass {.. variable w hull options IdleCallbacks.. constructor args {...# Extract the "widget name" from the object name...set w [namespace tail [self]].....# Configure things...

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\menu.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):39499
                                                                          Entropy (8bit):4.928671503514817
                                                                          Encrypted:false
                                                                          SSDEEP:768:NKJsO5OhIzOQjJwxzire5pKVjriecYyq4Cp5Zn2:NKJsO5LOQizire54lriecYf4V
                                                                          MD5:078782CD05209012A84817AC6EF11450
                                                                          SHA1:DBA04F7A6CF34C54A961F25E024B6A772C2B751D
                                                                          SHA-256:D1283F67E435AAB0BDBE9FDAA540A162043F8D652C02FE79F3843A451F123D89
                                                                          SHA-512:79A031F7732AEE6E284CD41991049F1BB715233E011562061CD3405E5988197F6A7FB5C2BBDDD1FB9B7024047F6003A2BF161FC0EC04876EFF5335C3710D9562
                                                                          Malicious:false
                                                                          Preview:# menu.tcl --..#..# This file defines the default bindings for Tk menus and menubuttons...# It also implements keyboard traversal of menus and implements a few..# other utility procedures related to menus...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# cursor -..Saves the -cursor option for the posted menubutton...# focus -..Saves the focus during a menu selection operation...#...Focus gets restored here when the menu is unposted...# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if..#...tk::Priv(oldGrab) is non

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\mkpsenc.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):30840
                                                                          Entropy (8bit):5.142909056222569
                                                                          Encrypted:false
                                                                          SSDEEP:768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
                                                                          MD5:983C7B78F1A0EBACAB8006D391A01FCD
                                                                          SHA1:7EA37474EA039ED7A37BFDD7D76EAE673E666283
                                                                          SHA-256:C5BDCA3ABA671F03DC4624AB5FD260490F5002491D6C619142CCF5A1A744528A
                                                                          SHA-512:A006EF9B7213E572F6FC540D1512A52C52FEC44E3A07846DE09662AE32B7191C5CF639798531847B39E4076BF9DD6314B6F5373065C04F4FEF221185B39C3117
                                                                          Malicious:false
                                                                          Preview:# mkpsenc.tcl --..#..# This file generates the postscript prolog used by Tk.....namespace eval ::tk {.. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically.. # handle any 8-bit encoding, but Tk never generates characters outside.. # ASCII)... #.. proc CreatePostscriptEncoding {} {...variable psglyphs...# Now check for known. Even if it is known, it can be other than we...# need. GhostScript seems to be happy with such approach...set result "\[\n"...for {set i 0} {$i<256} {incr i 8} {... for {set j 0} {$j<8} {incr j} {....set enc [encoding convertfrom "iso8859-1" \.....[format %c [expr {$i+$j}]]]....catch {.... set hexcode {}.... set hexcode [format %04X [scan $enc %c]]....}....if {[info exists psglyphs($hexcode)]} {.... append result "/$psglyphs($hexcode)"....} else {.... append result "/space"....}... }... append result "\n"...}...append result "\]"...return $result.. }.... # List of adobe glyph names. Converted from glyph

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgbox.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):16786
                                                                          Entropy (8bit):4.717927930017041
                                                                          Encrypted:false
                                                                          SSDEEP:192:+haZOxBpK8uxGe4V88/wxY3Fxqipz4zz4zxxFzxT4OcErDxqdRRZeuC/Vj2CoopC:+hRWRG3FFjvsfCoopwITHzLHFHHAABs
                                                                          MD5:217087AB6B2A8F9D7252E311D69C3769
                                                                          SHA1:09AEB2BC5B7C7F4AB3DE4211D786C519AE0970F6
                                                                          SHA-256:A07E3A3809CED3C6C9C1E171DCA5AD1F28357734CD41B2B9DD9F58085B3D2842
                                                                          SHA-512:6E57633C924BFC16D380C014C20DD24D5727E70D4843FCEC4D7995B4DB21941EA8F2A5FD6E5386DF3364B6905D4D66B2B9595DC8FC70CFF40A2D49A92A1B6FBA
                                                                          Malicious:false
                                                                          Preview:# msgbox.tcl --..#..#.Implements messageboxes for platforms that do not have native..#.messagebox support...#..# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# Ensure existence of ::tk::dialog namespace..#..namespace eval ::tk::dialog {}....image create bitmap ::tk::dialog::b1 -foreground black \..-data "#define b1_width 32\n#define b1_height 32..static unsigned char q1_bits[] = {.. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,.. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,.. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x04, 0x00,

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\cs.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4235
                                                                          Entropy (8bit):4.789130604359491
                                                                          Encrypted:false
                                                                          SSDEEP:48:nlw9Twd+j3gLhokqwX+hTnJgNanPNcgRhgP+5QPwJJENL:nlw9TjjwI3hTnJgNaRhgP75L
                                                                          MD5:5A8B46B85DCCBF74E2B5B820E1A7B9D1
                                                                          SHA1:980F4FC5BABA82BA0FE02F9BD03A23DF6D565BB1
                                                                          SHA-256:4DFFBEEDBF0D66D84B13088016D1A782CEAAD4DED27BE1E38842F8969C0E533F
                                                                          SHA-512:2D81FC06CF3C20E4F6314BD13AF81FDE38A9B06510584C84C6A0C8C36314F980F77D02BD8056E7EE5DE599A0620E0C0349124147334B9C141145270046B19D90
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it".. ::msgcat::mcset cs "&About..." "&O programu...".. ::msgcat::mcset cs "All Files" "V\u0161echny soubory".. ::msgcat::mcset cs "Application Error" "Chyba programu".. ::msgcat::mcset cs "Bold Italic".. ::msgcat::mcset cs "&Blue" "&Modr\341".. ::msgcat::mcset cs "Cancel" "Zru\u0161it".. ::msgcat::mcset cs "&Cancel" "&Zru\u0161it".. ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.".. ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e".. ::msgcat::mcset cs "Cl&ear" "Sma&zat".. ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu".. ::msgcat::mcset cs "Color" "Barva".. ::msgcat::mcset cs "Console" "Konzole".. ::msgcat::mcset cs "&Copy" "&Kop\355rovat".. ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout".. ::msgcat::mcset cs "&

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\da.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3987
                                                                          Entropy (8bit):4.651948695787255
                                                                          Encrypted:false
                                                                          SSDEEP:48:nRZ2uDMr05sIEzs2KkrT+XuTKN0FjDDP9:nRZzDy4kBKkrT+QpP9
                                                                          MD5:227B0F255F854460E8E5146ED7A17B85
                                                                          SHA1:99A080CAD631F21963C51A5B254BDAD3724DC866
                                                                          SHA-256:FEEF8F8AD33BB3362C845A25D6ED273C398051047D899B31790474614C7AFD2D
                                                                          SHA-512:36A4B48831316CC29686CC76DA00110EB078EC56F55A960D11AE427AA3D913C340C1E3805BF2AD40C1A8A92FC6587DA5D2C245E7501289FC3E228BE14FE49598
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset da "&Abort" "&Afbryd".. ::msgcat::mcset da "&About..." "&Om...".. ::msgcat::mcset da "All Files" "Alle filer".. ::msgcat::mcset da "Application Error" "Programfejl".. ::msgcat::mcset da "&Blue" "&Bl\u00E5".. ::msgcat::mcset da "Cancel" "Annuller".. ::msgcat::mcset da "&Cancel" "&Annuller".. ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.".. ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog".. ::msgcat::mcset da "Cl&ear" "&Ryd".. ::msgcat::mcset da "&Clear Console" "&Ryd konsolen".. ::msgcat::mcset da "Color" "Farve".. ::msgcat::mcset da "Console" "Konsol".. ::msgcat::mcset da "&Copy" "&Kopier".. ::msgcat::mcset da "Cu&t" "Kli&p".. ::msgcat::mcset da "&Delete" "&Slet".. ::msgcat::mcset da "Details >>" "Detailer".. ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" finde

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\de.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4914
                                                                          Entropy (8bit):4.6221938909259475
                                                                          Encrypted:false
                                                                          SSDEEP:96:nxLEpatioUqGBLbz4ME/XKKVN9R7S/0oYr9:epY3MkXKKxRu2r9
                                                                          MD5:2203F65BCDA61BC15AEAC4F868C6D94A
                                                                          SHA1:C4CC3975679D23892406E4E8971359A0775B1B86
                                                                          SHA-256:C0F574B14068A049E93421C73873D750C98DE28B7B77AA42FE72CBE0270A4186
                                                                          SHA-512:79F134FDAD3B12524D43BF9F59D3C04CAE30A95F591A51B82C8DF7CC8563BEA5D464AEECC457D9F60C04365E30459C447ED537AFC832BA25E1815DE06C2B81E5
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset de "&Abort" "&Abbruch".. ::msgcat::mcset de "&About..." "&\u00dcber...".. ::msgcat::mcset de "All Files" "Alle Dateien".. ::msgcat::mcset de "Application Error" "Applikationsfehler".. ::msgcat::mcset de "&Apply" "&Anwenden".. ::msgcat::mcset de "Bold" "Fett".. ::msgcat::mcset de "Bold Italic" "Fett kursiv".. ::msgcat::mcset de "&Blue" "&Blau".. ::msgcat::mcset de "Cancel" "Abbruch".. ::msgcat::mcset de "&Cancel" "&Abbruch".. ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.".. ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis".. ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen".. ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen".. ::msgcat::mcset de "Color" "Farbe".. ::msgcat::mcset de "Console" "Konsole".. ::msgcat::mcset de "&Copy" "&Kopieren".. ::msgcat::mcset de "

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\el.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8784
                                                                          Entropy (8bit):4.334043617395095
                                                                          Encrypted:false
                                                                          SSDEEP:48:tVj/F+oxBHbkI8+xTqFt2zPJ0k63fRGIUvPXrfBNnzc+zIF7meUOT7GC8MO07S0g:fj9+AHlLoozHn7fBFrMVmehCAGb
                                                                          MD5:780F863903BBDAA6C371EC0D3C7E6D59
                                                                          SHA1:DF5D435E132BEE4C076A7FC577C8C275A8B68CD5
                                                                          SHA-256:3F6F155864FE59A341BFD869735E54DD21CEE21BBD038433D9B271AD77BA3F7E
                                                                          SHA-512:091965EE912513AE1943BE840A2E757188FBA6F760F7C47BE80D06313D59B051F183E3A29D4B1CEDE1F9E54CA3CA23D75FF2C3A3672A4E71FB56F0FA76F7FA0D
                                                                          Malicious:false
                                                                          Preview:## Messages for the Greek (Hellenic - "el") language...## Please report any changes/suggestions to:..## petasis@iit.demokritos.gr....namespace eval ::tk {.. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2".. ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...".. ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1".. ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2".. ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5".. ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7".. ::msgcat::mcset el \.."Cannot change to the directory \"%1\$s\".\nPermission denied." \.."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\en.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3377
                                                                          Entropy (8bit):4.279601088621442
                                                                          Encrypted:false
                                                                          SSDEEP:24:sQ7dw5bO0V3gqmCNyoKJ6iwp/uvENv4SKEcET2hsHFjr:n7dwNOc3RmOKJQcvEl4SK1ET2hYFjr
                                                                          MD5:D48CFC9EC779085E8F6AAA7B1C40C89A
                                                                          SHA1:0CF6253BFF39F40CA0991F9B06D3394BFEA21ED2
                                                                          SHA-256:4A33B44B2E220E28EAAE7FAC407CAFE43D97C270DA58FA5F3B699A1760BFB2A4
                                                                          SHA-512:C00EC0CFB48ABE621EF625C51952BCF177CE3BC7F0DEC5276EF84C9A97C7E014806B106EA8DEE202C43F8DD54ED7261A8D899E3EE12E3F37A90C387D864463AE
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset en "&Abort".. ::msgcat::mcset en "&About...".. ::msgcat::mcset en "All Files".. ::msgcat::mcset en "Application Error".. ::msgcat::mcset en "&Apply".. ::msgcat::mcset en "Bold".. ::msgcat::mcset en "Bold Italic".. ::msgcat::mcset en "&Blue".. ::msgcat::mcset en "Cancel".. ::msgcat::mcset en "&Cancel".. ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.".. ::msgcat::mcset en "Choose Directory".. ::msgcat::mcset en "Cl&ear".. ::msgcat::mcset en "&Clear Console".. ::msgcat::mcset en "Color".. ::msgcat::mcset en "Console".. ::msgcat::mcset en "&Copy".. ::msgcat::mcset en "Cu&t".. ::msgcat::mcset en "&Delete".. ::msgcat::mcset en "Details >>".. ::msgcat::mcset en "Directory \"%1\$s\" does not exist.".. ::msgcat::mcset en "&Directory:".. ::msgcat::mcset en "&Edit".. ::msgcat::mcset en "Effects".. ::msgcat::mcset en "Error: %1\$s".. ::msgcat::mcs

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\en_gb.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):66
                                                                          Entropy (8bit):4.262228832346611
                                                                          Encrypted:false
                                                                          SSDEEP:3:fEGp6fRyv//mGoW8vMKEQXyVn:sooyv//xoQOOn
                                                                          MD5:3D41FC47CD9936F817EF9645D73A77ED
                                                                          SHA1:E62BBE094B71CAF4A389DE3ECD84D2EEFBA33827
                                                                          SHA-256:01238293356E82F1D298896491F8B299BB7DC9C34F299C9E756254C736DA612B
                                                                          SHA-512:B92582C32C4D7CD9DE6571CBB6B93DD693A8B5A80645468E2D02B80C339BE2B95D5B4878A0DA9AFFE9E2F98A6C38AAE9CC1FF2440146D0ED128FE8C9A92EECDB
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset en_gb Color Colour..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\eo.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3991
                                                                          Entropy (8bit):4.605712650627941
                                                                          Encrypted:false
                                                                          SSDEEP:48:n680lhrzes/QEkFH+nl0WXqQ+pISIKU/ujHMytuXcFSpxvy:n680XeqfkFelPXqVpISIKUWgRTy
                                                                          MD5:E44F82EAF651D065CA1A2D5FA3C91C25
                                                                          SHA1:F0EA1C39DED47232B21D0DCDD5179071C5717C55
                                                                          SHA-256:37FC66686349A955935CB24B0BD524E91823D2A631E63D54FDF17733C7502CBE
                                                                          SHA-512:A2ECA0A1C06406158CA8D2066639C0C6B582969D5F01C0559838E93A3AEFFFC50EB54B26328DAA81742016650FC790B1F81841E40EFE4F885626902D82989DD7
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset eo "&Abort" "&\u0108esigo".. ::msgcat::mcset eo "&About..." "Pri...".. ::msgcat::mcset eo "All Files" "\u0108ioj dosieroj".. ::msgcat::mcset eo "Application Error" "Aplikoerraro".. ::msgcat::mcset eo "&Blue" "&Blua".. ::msgcat::mcset eo "Cancel" "Rezignu".. ::msgcat::mcset eo "&Cancel" "&Rezignu".. ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u0109angi al dosierulon \"%1\$s\".\nVi ne rajtas tion.".. ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujo".. ::msgcat::mcset eo "Cl&ear" "&Klaru".. ::msgcat::mcset eo "&Clear Console" "&Klaru konzolon".. ::msgcat::mcset eo "Color" "Farbo".. ::msgcat::mcset eo "Console" "Konzolo".. ::msgcat::mcset eo "&Copy" "&Kopiu".. ::msgcat::mcset eo "Cu&t" "&Enpo\u015digu".. ::msgcat::mcset eo "&Delete" "&Forprenu".. ::msgcat::mcset eo "Details >>" "Detaloj >>".. ::msgcat::mcset eo "Directory \"%1\$s\" does not ex

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\es.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4024
                                                                          Entropy (8bit):4.536517819515934
                                                                          Encrypted:false
                                                                          SSDEEP:48:nN0T1Lt8ZYSih/aiik148aFscyTzoixccUTqjcg60Dx/H5:nN0BLSQUXy/o8re055
                                                                          MD5:4765F3C055742530E4644771EBC6C69F
                                                                          SHA1:8BEA722AC00522DEAA5B380AEEF4CA57D7A271BD
                                                                          SHA-256:D2842B80F1B521EFF2D2656A69274B5F2A8F4F5831AF2E8EE73E3C37389F981F
                                                                          SHA-512:9CA247F22797A1A1FCA42B5CDABF58262ED95EECDDD321CEB1440A60A4375923E0F511238F360D159EB5EED6F82CBBE0B8907A07CC77DB831BF97082932CD0FD
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset es "&Abort" "&Abortar".. ::msgcat::mcset es "&About..." "&Acerca de ...".. ::msgcat::mcset es "All Files" "Todos los archivos".. ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n".. ::msgcat::mcset es "&Blue" "&Azul".. ::msgcat::mcset es "Cancel" "Cancelar".. ::msgcat::mcset es "&Cancel" "&Cancelar".. ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.".. ::msgcat::mcset es "Choose Directory" "Elegir directorio".. ::msgcat::mcset es "Cl&ear" "&Borrar".. ::msgcat::mcset es "&Clear Console" "&Borrar consola".. ::msgcat::mcset es "Color".. ::msgcat::mcset es "Console" "Consola".. ::msgcat::mcset es "&Copy" "&Copiar".. ::msgcat::mcset es "Cu&t" "Cor&tar".. ::msgcat::mcset es "&Delete" "&Borrar".. ::msgcat::mcset es "Details >>" "Detalles >>".. ::msgcat::mcset es "Directory \"%1\$s\"

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\fr.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3877
                                                                          Entropy (8bit):4.630737553723335
                                                                          Encrypted:false
                                                                          SSDEEP:48:nByEWs/3lHFB9FamsIfSAzZ2eaISAxh0BRc3jC:nByEWaRNzsSSWonMAv
                                                                          MD5:E279E5FFF03E1B8E9063ABC8A499A6BD
                                                                          SHA1:80910911F6B4830BA4DCBA9A9EAD12C9F802DDC9
                                                                          SHA-256:3F2CEB4A33695AB6B56E27F61A4C60C029935BB026497D99CB2C246BCB4A63C4
                                                                          SHA-512:8333388E421AC3F342317BEBE352809B0B190EF8B044A0BAE2FE4051974D86008BAFDCB7098E9DC39A8D9E1E08FB87F54B9D3388AF2D0185FF913DB6788C5AB5
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset fr "&Abort" "&Annuler".. ::msgcat::mcset fr "About..." "\u00c0 propos...".. ::msgcat::mcset fr "All Files" "Tous les fichiers".. ::msgcat::mcset fr "Application Error" "Erreur d'application".. ::msgcat::mcset fr "&Blue" "&Bleu".. ::msgcat::mcset fr "Cancel" "Annuler".. ::msgcat::mcset fr "&Cancel" "&Annuler".. ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.".. ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire".. ::msgcat::mcset fr "Cl&ear" "Effacer".. ::msgcat::mcset fr "Color" "Couleur".. ::msgcat::mcset fr "Console".. ::msgcat::mcset fr "Copy" "Copier".. ::msgcat::mcset fr "Cu&t" "Couper".. ::msgcat::mcset fr "Delete" "Effacer".. ::msgcat::mcset fr "Details >>" "D\u00e9tails >>".. ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\"

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\hu.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4678
                                                                          Entropy (8bit):4.7955991577265245
                                                                          Encrypted:false
                                                                          SSDEEP:96:nkCEz2TTrKmA17fzq/Hj+pUva+fQR/a5a/Thn5kU:kTqM17u/8NiMrhb
                                                                          MD5:4F1610E0C73DAE668E3F9D9235631152
                                                                          SHA1:63EE54A6C1A69B798C65C999D5F80A7AB252B6D8
                                                                          SHA-256:E063AD7CA93F37728A65E4CD7C0433950F22607D307949F6CB056446AFEAA4FE
                                                                          SHA-512:37F4B8A9CD020A77591C09AF40FBC2FA82107B2596D31B5F30CE6ECAA225417CF7A5C62FB7A93539B0D7E930D0A44F9BF2EE6BE113F831B0A72B229444672AFD
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s".. ::msgcat::mcset hu "&About..." "N\u00e9vjegy...".. ::msgcat::mcset hu "All Files" "Minden f\u00e1jl".. ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba".. ::msgcat::mcset hu "&Blue" "&K\u00e9k".. ::msgcat::mcset hu "Cancel" "M\u00e9gsem".. ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem".. ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.".. ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa".. ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s".. ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol".. ::msgcat::mcset hu "Color" "Sz\u00edn".. ::msgcat::mcset hu "Console" "Konzol".. ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s".. ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s".. ::ms

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\it.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3765
                                                                          Entropy (8bit):4.49679862548805
                                                                          Encrypted:false
                                                                          SSDEEP:48:nmU4xnonTjwUE5Xs6ZrT8BpXAg+Wr+u92C8t7mU9nUSs:nZ4FonFE58HBpXjr+fBJs
                                                                          MD5:B74C54666A5A431A782DB691B4CA3315
                                                                          SHA1:2BC63982C14BBA8A4C451CE31540181F40CE2216
                                                                          SHA-256:806930F283FD097195C7850E3486B3815D1564529B4F8E5FA6D26F3175183BC1
                                                                          SHA-512:8120E2FFD14E0A992E254796ADDC0DC995C921BE31688C0995D7A36FE82609D78791FEF73EAF5B14E2F0D40AD256AB8DAAA07C18E6950362B28E40B71E47C0B6
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset it "&Abort" "&Interrompi".. ::msgcat::mcset it "&About..." "Informazioni...".. ::msgcat::mcset it "All Files" "Tutti i file".. ::msgcat::mcset it "Application Error" "Errore dell' applicazione".. ::msgcat::mcset it "&Blue" "&Blu".. ::msgcat::mcset it "Cancel" "Annulla".. ::msgcat::mcset it "&Cancel" "&Annulla".. ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.".. ::msgcat::mcset it "Choose Directory" "Scegli una directory".. ::msgcat::mcset it "Cl&ear" "Azzera".. ::msgcat::mcset it "&Clear Console" "Azzera Console".. ::msgcat::mcset it "Color" "Colore".. ::msgcat::mcset it "Console".. ::msgcat::mcset it "&Copy" "Copia".. ::msgcat::mcset it "Cu&t" "Taglia".. ::msgcat::mcset it "Delete" "Cancella".. ::msgcat::mcset it "Details >>" "Dettagli >>".. ::msgcat::mcset it "Directory \"%1\$s\" does not ex

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\nl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4557
                                                                          Entropy (8bit):4.524344068436489
                                                                          Encrypted:false
                                                                          SSDEEP:48:nucQswBju0x0M4U2z9KSSOzZL5KhWTqGGIrlxXvhYbL/ZO5NT+T4kiLzzdDf1SDM:nLGa0x0Mp2KSHKSv2bL/ZO5u6nRfAXU9
                                                                          MD5:E56229BAC5A8ABB90C4DD8EE3F9FF9F8
                                                                          SHA1:7527D6C3C6C84BFF0E683FFA86A21C58458EB55D
                                                                          SHA-256:0914FBA42361227D14FA281E8A9CBF57C16200B4DA1E61CC3402EF0113A512C7
                                                                          SHA-512:13649DDB06DB4BA9E39BEAF828211086A519444DA9AB5CBDD1B88B29208388189A5141F75AD94B56A348EDDE534FFADE8B19B557CB988EA4ECC9A84B135D36C1
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset nl "&Abort" "&Afbreken".. ::msgcat::mcset nl "&About..." "Over...".. ::msgcat::mcset nl "All Files" "Alle Bestanden".. ::msgcat::mcset nl "Application Error" "Toepassingsfout".. ::msgcat::mcset nl "&Apply" "Toepassen".. ::msgcat::mcset nl "Bold" "Vet".. ::msgcat::mcset nl "Bold Italic" "Vet Cursief".. ::msgcat::mcset nl "&Blue" "&Blauw".. ::msgcat::mcset nl "Cancel" "Annuleren".. ::msgcat::mcset nl "&Cancel" "&Annuleren".. ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.".. ::msgcat::mcset nl "Choose Directory" "Kies map".. ::msgcat::mcset nl "Cl&ear" "Wissen".. ::msgcat::mcset nl "&Clear Console" "&Wis Console".. ::msgcat::mcset nl "Color" "Kleur".. ::msgcat::mcset nl "Console".. ::msgcat::mcset nl "&Copy" "Kopi\u00ebren".. ::msgcat::mcset nl "Cu&t" "Knippen".. ::msgcat::mcset nl "&Dele

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\pl.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4932
                                                                          Entropy (8bit):4.799369674927008
                                                                          Encrypted:false
                                                                          SSDEEP:48:nXra9E310fwNCeVsvSmy6MZv8lWBTDGdZ3tojTyrEQmAUCIx4wBxZ:n7a9Q0fyw5MQWgP3uoZChB3
                                                                          MD5:8CFA2E38822303FDCB55AE3277F0B81B
                                                                          SHA1:447F28A5064FCEA019C60B3F9B6D50CD43C2D0E3
                                                                          SHA-256:EACEB1F08DE0863CCF726881E07FE5B135EA09646C5253E0CBF7DDB987EB0D92
                                                                          SHA-512:E38BA9059AFF55C2B22A4AE24D6A76149C76DBA8BF8646AE81D6E07D7ED490D0605034B29D9AC848E6685C8EC26A3DBE5B2EAF462B14D96376E80076FBE7082A
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset pl "&Abort" "&Przerwij".. ::msgcat::mcset pl "&About..." "O programie...".. ::msgcat::mcset pl "All Files" "Wszystkie pliki".. ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie".. ::msgcat::mcset pl "&Apply" "Zastosuj".. ::msgcat::mcset pl "Bold" "Pogrubienie".. ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa".. ::msgcat::mcset pl "&Blue" "&Niebieski".. ::msgcat::mcset pl "Cancel" "Anuluj".. ::msgcat::mcset pl "&Cancel" "&Anuluj".. ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.".. ::msgcat::mcset pl "Choose Directory" "Wybierz katalog".. ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107".. ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119".. ::msgcat::mcset pl "Color" "Kolor".. ::msgcat::mcset pl "Console" "Konsola".. ::msgcat::mcset pl "&Copy" "&Kopiu

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\pt.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3987
                                                                          Entropy (8bit):4.63232183429232
                                                                          Encrypted:false
                                                                          SSDEEP:48:nHOT1mM5qHHxiBHb3joTjtcp2UqMxweo6VvilCMKKXx9vjM:nHOT1mMQnwB/otcUUpGX6VPVoLjM
                                                                          MD5:4018686F2A8E299D86BDB1478BC97896
                                                                          SHA1:0EECE3D57F2EA5EECE8157B06F3AFB97E1F2551A
                                                                          SHA-256:D687F71F0432BB0D02EFDF576E526D2C19D4136F76C41A3224A2F034168F3F34
                                                                          SHA-512:4D730068B2A21E1D6004205B10A9D0D5EE9683FEB03B6FB673E8B9B94ED6BE468086A52DFE97C4DBF35A07CBB2C5E276DF0952A06C78E029D53D796CB6FCC8DF
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset pt "&Abort" "&Abortar".. ::msgcat::mcset pt "About..." "Sobre ...".. ::msgcat::mcset pt "All Files" "Todos os arquivos".. ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o".. ::msgcat::mcset pt "&Blue" "&Azul".. ::msgcat::mcset pt "Cancel" "Cancelar".. ::msgcat::mcset pt "&Cancel" "&Cancelar".. ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.".. ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio".. ::msgcat::mcset pt "Cl&ear" "Apagar".. ::msgcat::mcset pt "&Clear Console" "Apagar Console".. ::msgcat::mcset pt "Color" "Cor".. ::msgcat::mcset pt "Console".. ::msgcat::mcset pt "&Copy" "Copiar".. ::msgcat::mcset pt "Cu&t" "Recortar".. ::msgcat::mcset pt "&Delete" "Excluir".. ::msgcat::mcset pt "Details >>" "Detalhes >>".. ::msgcat::mcset pt "D

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\ru.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7289
                                                                          Entropy (8bit):4.396417984959623
                                                                          Encrypted:false
                                                                          SSDEEP:96:n9MEBG2T4YHCIxqEMk0Y2xX6wKl9zFAWS2yuV9cDcPRjnHQuNFNfz5hVV9aWTRcD:dreFqN1T+oRR/F1RHR6
                                                                          MD5:803E0F9930828B103B03B55EDA173CB8
                                                                          SHA1:429A30A7546123B1895C4317C65A97EBCBD16F35
                                                                          SHA-256:8715E9927BA925AE8099EDF71A3D701FE396FC0E4DF039CEA7DC84120E101F47
                                                                          SHA-512:379739A2C84E35C1AC70EFA9F704D3D1455741FEB60F4A1D9B0E0FD6CC3279F66A0C63C0FADFD861498D3FE13AB9E633F2C1BB05E76B3206DECEA253FFB8E33C
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c".. ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...".. ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b".. ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435".. ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439".. ::msgcat::mcset ru "Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \....."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \"%1\$s\".\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\msgs\sv.msg

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3908
                                                                          Entropy (8bit):4.658068191079967
                                                                          Encrypted:false
                                                                          SSDEEP:48:nT8A5cbwKmtI1sE9xt6BDyepTr2iiK/yGqXZlBp9:nD5cb2extDepTCnVpJ9
                                                                          MD5:1D085A672A6FCDECEF5D7D876E4C74A3
                                                                          SHA1:1A40C03F15A6926359CA3E5C0A809485CAD28AEE
                                                                          SHA-256:A6821A13D34FB31F1827294B82C4BF9586BB255CA14F78C3ACE11181F42EF211
                                                                          SHA-512:981EDEEF5E4C915BB8F10044096B412D1855CAD08F98A448C6C0A49A54222945EBD102DDCB9525535E0FB19313C319155FA59384605B2C36CC8B4A58693D57E7
                                                                          Malicious:false
                                                                          Preview:namespace eval ::tk {.. ::msgcat::mcset sv "&Abort" "&Avsluta".. ::msgcat::mcset sv "&About..." "&Om...".. ::msgcat::mcset sv "All Files" "Samtliga filer".. ::msgcat::mcset sv "Application Error" "Programfel".. ::msgcat::mcset sv "&Blue" "&Bl\u00e5".. ::msgcat::mcset sv "Cancel" "Avbryt".. ::msgcat::mcset sv "&Cancel" "&Avbryt".. ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.".. ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp".. ::msgcat::mcset sv "Cl&ear" "&Radera".. ::msgcat::mcset sv "&Clear Console" "&Radera konsollen".. ::msgcat::mcset sv "Color" "F\u00e4rg".. ::msgcat::mcset sv "Console" "Konsoll".. ::msgcat::mcset sv "&Copy" "&Kopiera".. ::msgcat::mcset sv "Cu&t" "Klipp u&t".. ::msgcat::mcset sv "&Delete" "&Radera".. ::msgcat::mcset sv "Details >>" "Detaljer >>".. ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mapp

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\obsolete.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5772
                                                                          Entropy (8bit):5.038729016734604
                                                                          Encrypted:false
                                                                          SSDEEP:96:onzxtm7EMgdMjwPqeuAmz9LD1kFIQETZqoIK/RLf7w:ozxtm7qUwi79l0sZqoBJLDw
                                                                          MD5:FC9E03823BEB08DAF7681C09D106DF7D
                                                                          SHA1:7D06FC8F98140E0FFAA2571BD522FC772E58DE54
                                                                          SHA-256:540EEECBA17207A56290BAFFDAE882BBD4F88364791204AD5D14C7BEDD022CCC
                                                                          SHA-512:2B5BAD311A703A0FE2ED67ACE311BAD4C767BCD23DFC3D9ABDF5C3604146A6A15D6BD13A14BDEFCDB2B602C708AACFAB404E96FCBA7C546AD0DAECD4BE2EB34A
                                                                          Malicious:false
                                                                          Preview:# obsolete.tcl --..#..# This file contains obsolete procedures that people really shouldn't..# be using anymore, but which are kept around for backward compatibility...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# The procedures below are here strictly for backward compatibility with..# Tk version 3.6 and earlier. The procedures are no longer needed, so..# they are no-ops. You should not use these procedures anymore, since..# they may be removed in some future release.....proc tk_menuBar args {}..proc tk_bindForTraversal args {}....# ::tk::classic::restore --..#..# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic..# Tk widgets...#..# The value following an 'option add' call is the new 8.5 value...#..namespace eval ::tk::classic {.. # This may need t

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\optMenu.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1629
                                                                          Entropy (8bit):4.784780799273752
                                                                          Encrypted:false
                                                                          SSDEEP:48:g2hBuOrlkBytcqYXRE5fvvXq1EhJPqOj6Wf0cVlN:gQ6q4E5HCqhBqOhcaD
                                                                          MD5:9B7A8FD2C6B538FF31BDC380452C6DE3
                                                                          SHA1:3F915BFE85CED9F6C7E9A352718770E9F14F098E
                                                                          SHA-256:40CA505C9784B0767D4854485C5C311829594A4FCBDFD7251E60E6BB7EA74FD1
                                                                          SHA-512:43937152B844BE1E597E99DA1270E54AB1D572AE89CB759E6D41C18C9C8044CCC15A6925F9C5AF617AE9EC1404E78C2733231F4D5C6CFE4D23C546387B1FC328
                                                                          Malicious:false
                                                                          Preview:# optMenu.tcl --..#..# This file defines the procedure tk_optionMenu, which creates..# an option button and its associated menu...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_optionMenu --..# This procedure creates an option button named $w and an associated..# menu. Together they provide the functionality of Motif option menus:..# they can be used to select one of many values, and the current value..# appears in the global variable varName, as well as in the text of..# the option menubutton. The name of the menu is returned as the..# procedure's result, so that the caller can use it to change configuration..# options on the menu or otherwise manipulate it...#..# Arguments:..# w -...The name to use for the menubutton...# varName -..Global variable to hold the currently

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\palette.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8418
                                                                          Entropy (8bit):4.964814946573677
                                                                          Encrypted:false
                                                                          SSDEEP:192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
                                                                          MD5:4CE08A10CD9AE941654B8C679DF669F3
                                                                          SHA1:F1288BABCA698FD18C3BD221E6AE6C02F2975AAE
                                                                          SHA-256:849B4C57E4644E51BEAEAEB3AE59B7FF067E582ECD10F1B2CAF6B6E72F11F506
                                                                          SHA-512:0F37539DA3540E9B1DA7B0377E3BBB359B71DB4271D63BC9501E95931B4E609E8CB91DC2F7B08A6452598D4A0D58C6A2034049A215000EEF0F93A9963D003632
                                                                          Malicious:false
                                                                          Preview:# palette.tcl --..#..# This file contains procedures that change the color palette used..# by Tk...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_setPalette --..# Changes the default color scheme for a Tk application by setting..# default colors in the option database and by modifying all of the..# color options for existing widgets that have the default value...#..# Arguments:..# The arguments consist of either a single color name, which..# will be used as the new background color (all other colors will..# be computed from this) or an even number of values consisting of..# option names and values. The name for an option is the one used..# for the option database, such as activeForeground, not -activeforeground.....proc ::tk_setPalette {args} {.. if {[winfo depth .] == 1} {...# Just return on monochrome displays, otherwise errors

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\panedwindow.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5370
                                                                          Entropy (8bit):4.979530133775421
                                                                          Encrypted:false
                                                                          SSDEEP:96:ssAXzkTQ9w5fLQYkJLZkRXKUXfwyZTq2sz8j2Em3YKhrYK:jAXgE0DQpJLGR6UXfpqnzG3m3YKhrYK
                                                                          MD5:286C01A1B12261BC47F5659FD1627ABD
                                                                          SHA1:4CA36795CAB6DFE0BBBA30BB88A2AB71A0896642
                                                                          SHA-256:AA4F87E41AC8297F51150F2A9F787607690D01793456B93F0939C54D394731F9
                                                                          SHA-512:D54D5A89B7408A9724A1CA1387F6473BDAD33885194B2EC5A524C7853A297FD65CE2A57F571C51DB718F6A00DCE845DE8CF5F51698F926E54ED72CDC81BCFE54
                                                                          Malicious:false
                                                                          Preview:# panedwindow.tcl --..#..# This file defines the default bindings for Tk panedwindow widgets and..# provides procedures that help in implementing those bindings.....bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }..bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }....bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }..bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }....bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}..bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}....bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }....bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }....# Initialize namespace..namespace eval ::tk::panedwindow {}....# ::tk::panedwindow::MarkSash --..#..# Handle marking the correct sash for possible dragging..#..# Arguments:..# w..the widget..# x..widget local x coord..# y..widget local y coord..# proxy.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\pkgIndex.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):376
                                                                          Entropy (8bit):5.040809246948068
                                                                          Encrypted:false
                                                                          SSDEEP:6:CsUgabAOgjDnzJNBc6ynID/cL4RpncleXN17MQ9PQqBIQ08hof7MQ9PQqBIQei:lGbyntNO6LYZliPBIUhkPBIFi
                                                                          MD5:3367CE12A4BA9BAAF7C5127D7412AA6A
                                                                          SHA1:865C775BB8F56C3C5DFC8C71BFAF9EF58386161D
                                                                          SHA-256:3F2539E85E2A9017913E61FE2600B499315E1A6F249A4FF90E0B530A1EEB8898
                                                                          SHA-512:F5D858F17FE358762E8FDBBF3D78108DBA49BE5C5ED84B964143C0ADCE76C140D904CD353646EC0831FF57CD0A0AF864D1833F3946A235725FFF7A45C96872EB
                                                                          Malicious:false
                                                                          Preview:if {![package vsatisfies [package provide Tcl] 8.6.0]} return..if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]...|| ([info exists ::argv] && ("-display" in $::argv)))} {.. package ifneeded Tk 8.6.12 [list load [file join $dir .. .. bin libtk8.6.dll]]..} else {.. package ifneeded Tk 8.6.12 [list load [file join $dir .. .. bin tk86t.dll]]..}..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\safetk.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):7632
                                                                          Entropy (8bit):4.891666209090638
                                                                          Encrypted:false
                                                                          SSDEEP:192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
                                                                          MD5:21A3AC11146EC26784C0E729D8D644D0
                                                                          SHA1:C7E0918E8692C42C1D1DD1BBCBFFF22A85979B69
                                                                          SHA-256:579701605669AADFFBCDB7E3545C68442495428EE6E93C2D3A3133583BCD3D33
                                                                          SHA-512:724ED83B989AD9033BEC4211EE50E4C9E85B51054C518CDF7E02D0ED0416F636B9F38C0B0D29F8F4F7F465B77C7D2E01D0918D2C2C3FEC4C7739EA982302FA2E
                                                                          Malicious:false
                                                                          Preview:# safetk.tcl --..#..# Support procs to use Tk in safe interpreters...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# see safetk.n for documentation....#..#..# Note: It is now ok to let untrusted code being executed..# between the creation of the interp and the actual loading..# of Tk in that interp because the C side Tk_Init will..# now look up the parent interp and ask its safe::TkInit..# for the actual parameters to use for it's initialization (if allowed),..# not relying on the child state...#....# We use opt (optional arguments parsing)..package require opt 0.4.1;....namespace eval ::safe {.... # counter for safe toplevels.. variable tkSafeId 0..}....#..# tkInterpInit : prepare the child interpreter for tk loading..# most of the real job is done by loadTk..# returns the child name (tkInterpInit

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\scale.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8056
                                                                          Entropy (8bit):4.979589163397994
                                                                          Encrypted:false
                                                                          SSDEEP:96:GSusE8YOdpO4aDtao+QYa6t2jooB6ajpaqa5xQz9MUKOC9dLrVx:KsbYQO48t+QYa+NkFjpaQz5KX9dLrVx
                                                                          MD5:857ADD6060A986063B0ED594F6B0CD26
                                                                          SHA1:B1981D33DDEA81CFFFA838E5AC80E592D9062E43
                                                                          SHA-256:0DA2DC955FFD71062A21C3B747D9D59D66A5B09A907B9ED220BE1B2342205A05
                                                                          SHA-512:7D9829565EFC8CDBF9249913DA95B02D8DADFDB3F455FD3C10C5952B5454FE6E54D95C07C94C1E0D7568C9742CAA56182B3656E234452AEC555F0FCB76A59FB1
                                                                          Malicious:false
                                                                          Preview:# scale.tcl --..#..# This file defines the default bindings for Tk scale widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for entries...#-------------------------------------------------------------------------....# Standard Motif bindings:....bind Scale <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. tk::ScaleActivate %W %x %y..}..bind Scale <Motion> {.. tk::ScaleActivate %W %x %y..}..bind Scale <Leave> {.. if {$tk_strictMotif} {...%W configure -activebackground

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\scrlbar.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):13188
                                                                          Entropy (8bit):5.063842571848725
                                                                          Encrypted:false
                                                                          SSDEEP:192:Gf7RV8ei32PHKT8H2wwucyRlXn+kl1nBKp4nu5FCyK:2mei3qHKT8WPurnXn+I1nBg4nu5MyK
                                                                          MD5:5249CD1E97E48E3D6DEC15E70B9D7792
                                                                          SHA1:612E021BA25B5E512A0DFD48B6E77FC72894A6B9
                                                                          SHA-256:EEC90404F702D3CFBFAEC0F13BF5ED1EBEB736BEE12D7E69770181A25401C61F
                                                                          SHA-512:E4E0AB15EB9B3118C30CD2FF8E5AF87C549EAA9B640FFD809A928D96B4ADDEFB9D25EFDD1090FBD0019129CDF355BB2F277BC7194001BA1D2ED4A581110CEAFC
                                                                          Malicious:false
                                                                          Preview:# scrlbar.tcl --..#..# This file defines the default bindings for Tk scrollbar widgets...# It also provides procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for scrollbars...#-------------------------------------------------------------------------....# Standard Motif bindings:..if {[tk windowingsystem] eq "x11" || [tk windowingsystem] eq "aqua"} {....bind Scrollbar <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. %W activate [%W identify %x %y]..}..bind Scrollbar <Motion> {.. %W activate [%

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\spinbox.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):16526
                                                                          Entropy (8bit):5.033807343600737
                                                                          Encrypted:false
                                                                          SSDEEP:384:IMpfy/Ku9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfy/Ku9Tx8WODTp2zPP
                                                                          MD5:77DFE1BACCD165A0C7B35CDEAA2D1A8C
                                                                          SHA1:426BA77FC568D4D3A6E928532E5BEB95388F36A0
                                                                          SHA-256:2FF791A44406DC8339C7DA6116E6EC92289BEE5FC1367D378F48094F4ABEA277
                                                                          SHA-512:E56DB85296C8661AB2EA0A56D9810F1A4631A9F9B41337560CBE38CCDF7DD590A3E65C22B435CE315EFF55EE5B8E49317D4E1B7577E25FC3619558015DD758EB
                                                                          Malicious:false
                                                                          Preview:# spinbox.tcl --..#..# This file defines the default bindings for Tk spinbox widgets and provides..# procedures that help in implementing those bindings. The spinbox builds..# off the entry widget, so it can reuse Entry bindings and procedures...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1999-2000 Jeffrey Hobbs..# Copyright (c) 2000 Ajuba Solutions..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#.

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\tclIndex

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):20523
                                                                          Entropy (8bit):4.786929402401609
                                                                          Encrypted:false
                                                                          SSDEEP:384:eeVL0UI9Ms++J7VT/hc+ISyNsATbOan/uW/UFQ1gs1gxtKZufe2SvdJcmq/YbhEB:eeF0UI9Ms++J7VT/hc+ISyCATbOan2W+
                                                                          MD5:9378397DD3DCA9DFB181F6F512B15631
                                                                          SHA1:4F95DD6B658B6A912725DC7D6226F8414020D6C7
                                                                          SHA-256:B04B1A675572E6FCD12C5FE82C4FD0930395548436FF93D848BF340AE202E7E3
                                                                          SHA-512:D28CC3C8F3D0B1B2371CBD9EE29AC6881BABD8A07C762FF8F3284449998EE44FA44752CC8AB0DE47A3492776CE1D13BC8EA18CFDBDF710639D2D62D02CB917A9
                                                                          Malicious:false
                                                                          Preview:# Tcl autoload index file, version 2.0..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]]..set auto_index(::tk::ButtonAutoInvoke) [list sou

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\tearoff.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5309
                                                                          Entropy (8bit):4.74935501162253
                                                                          Encrypted:false
                                                                          SSDEEP:96:wfQXIqAv6iEwYtKVlPBnXWASbvMsDjXKpQQkK2tTsSZQ7Fowqm2K5r:wf+IqI6iU43PJYbvMsDjXKpsK2tISyZV
                                                                          MD5:5F042DE8AD8941C7B9EF6D7BE06C86E4
                                                                          SHA1:A4DFCEA2ACCAC2E85EAAA186DC765086D1E3AA3C
                                                                          SHA-256:A4A8568633F827B54326640E6D1C3FDE4978EDC9E9FA1FB1D7B58F189DF1B1DC
                                                                          SHA-512:E92A00028696A1557666CAB1C25AE6B63F25D75A9811BFAC56DFC069ECC769CC751B71CC81FA85C9CDE8F7FB6D7121EB64B58548CEE8AFE3F6C4A5C243507216
                                                                          Malicious:false
                                                                          Preview:# tearoff.tcl --..#..# This file contains procedures that implement tear-off menus...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk::TearoffMenu --..# Given the name of a menu, this procedure creates a torn-off menu..# that is identical to the given menu (including nested submenus)...# The new torn-off menu exists as a toplevel window managed by the..# window manager. The return value is the name of the new menu...# The window is created at the point specified by x and y..#..# Arguments:..# w -...The menu to be torn-off (duplicated)...# x -...x coordinate where window is created..# y -...y coordinate where window is created....proc ::tk::TearOffMenu {w {x 0} {y 0}} {.. # Find a unique name to use for the torn-off menu. Find the first.. # ancestor of w that is a

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\text.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):34961
                                                                          Entropy (8bit):4.958000555615616
                                                                          Encrypted:false
                                                                          SSDEEP:768:Rp4LaQDlJrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:R/K8aymTGs1b0xncn6KR
                                                                          MD5:7C2AC370DE0B941AE13572152419C642
                                                                          SHA1:7598CC20952FA590E32DA063BF5C0F46B0E89B15
                                                                          SHA-256:4A42AD370E0CD93D4133B49788C0B0E1C7CD78383E88BACB51CB751E8BFDA15E
                                                                          SHA-512:8325A33BFD99F0FCE4F14ED5DC6E03302F6FFABCE9D1ABFEFC24D16A09AB3439A4B753CBF06B28D8C95E4DDABFB9082C9B030619E8955A7E656BD6C61B9256C3
                                                                          Malicious:false
                                                                          Preview:# text.tcl --..#..# This file defines the default bindings for Tk text widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of ::tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# char -..Character position on the line; kept in order..#...to allow moving up or down past short lines while..#...still remembering the desired position...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button we

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\tk.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):24266
                                                                          Entropy (8bit):5.1375522500072925
                                                                          Encrypted:false
                                                                          SSDEEP:384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
                                                                          MD5:338184E46BD23E508DAEDBB11A4F0950
                                                                          SHA1:437DB31D487C352472212E8791C8252A1412CB0E
                                                                          SHA-256:0F617D96CBF213296D7A5F7FCFFBB4AE1149840D7D045211EF932E8DD66683E9
                                                                          SHA-512:8FB8A353EECD0D19638943F0A9068DCCEBF3FB66D495EA845A99A89229D61A77C85B530F597FD214411202055C1FAA9229B6571C591C9F4630490E1EB30B9CD3
                                                                          Malicious:false
                                                                          Preview:# tk.tcl --..#..# Initialization script normally executed in the interpreter for each Tk-based..# application. Arranges class bindings for widgets...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....# Verify that we have Tk binary and script components from the same release..package require -exact Tk 8.6.12.....# Create a ::tk namespace..namespace eval ::tk {.. # Set up the msgcat commands.. namespace eval msgcat {...namespace export mc mcmax.. if {[interp issafe] || [catch {package require msgcat}]} {.. # The msgcat package is not available. Supply our own.. # minimal replacement... proc mc {src args} {.. return [format $src {*}$args].. }.. proc mc

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\tkfbox.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):39613
                                                                          Entropy (8bit):5.1830399016984146
                                                                          Encrypted:false
                                                                          SSDEEP:768:+oj+AqE9cn9eJNgDN0/vsKulXgx65Eh6pSb:+6+ZM/gAEdix65Ehpb
                                                                          MD5:47635811AAA1CEB26EDA3930D91C8855
                                                                          SHA1:F071757BED525AF8CA21BFA0FCA89EC3F95AA278
                                                                          SHA-256:595A0B05EB2CBD4CF489E57624B509FC3B4885E6410CA6416E7521D23694373D
                                                                          SHA-512:A374126EC28E70C89EE247A591C2168DF55E110F260664F46F470C53CDA3A2411C3775391FC8FD575CEE69CD1768512E68CDDCB335204D00B9EB81906AC79344
                                                                          Malicious:false
                                                                          Preview:# tkfbox.tcl --..#..#.Implements the "TK" standard file selection dialog box. This dialog..#.box is used on the Unix platforms whenever the tk_strictMotif flag is..#.not set...#..#.The "TK" standard file selection dialog box is similar to the file..#.selection dialog box on Win95(TM). The user can navigate the..#.directories by clicking on the folder icons or by selecting the..#."Directory" option menu. The user can select files by clicking on the..#.file icons or by entering a filename in the "Filename:" entry...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {.. namespace import -force ::tk::msgcat::*.. variable showHiddenBtn 0.. variable showHiddenVar 1.... # Create the images if they did not already exist... if {![info exists ::tk::Priv(updirImage)]} {...s

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\altTheme.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3713
                                                                          Entropy (8bit):4.915055696129498
                                                                          Encrypted:false
                                                                          SSDEEP:48:InrWdo3L7Fe5qusQGdrMNnQbfIxEOxE0kFgG0FgGouox9FrGVuwg3kNcT+z5UlEr:UWdsOBn/1i+pqxwNjKs
                                                                          MD5:01F28512E10ACBDDF93AE2BB29E343BC
                                                                          SHA1:C9CF23D6315218B464061F011E4A9DC8516C8F1F
                                                                          SHA-256:AE0437FB4E0EBD31322E4EACA626C12ABDE602DA483BB39D0C5EE1BC00AB0AF4
                                                                          SHA-512:FE3BAE36DDB67F6D7A90B7A91B6EC1A009CF26C0167C46635E5A9CEAEC9083E59DDF74447BF6F60399657EE9604A2314B170F78A921CF948B2985DDF02A89DA6
                                                                          Malicious:false
                                                                          Preview:#..# Ttk widget set: Alternate theme..#....namespace eval ttk::theme::alt {.... variable colors.. array set colors {...-frame .."#d9d9d9"...-window.."#ffffff"...-darker ."#c3c3c3"...-border.."#414141"...-activebg ."#ececec"...-disabledfg."#a3a3a3"...-selectbg."#4a6984"...-selectfg."#ffffff"...-altindicator."#aaaaaa".. }.... ttk::style theme settings alt {.....ttk::style configure "." \... -background .$colors(-frame) \... -foreground .black \... -troughcolor.$colors(-darker) \... -bordercolor.$colors(-border) \... -selectbackground .$colors(-selectbg) \... -selectforeground .$colors(-selectfg) \... -font ..TkDefaultFont \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)] ;...ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -padding "1 1" \... -reli

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\aquaTheme.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3838
                                                                          Entropy (8bit):4.940737732832436
                                                                          Encrypted:false
                                                                          SSDEEP:48:WdbclJFvlyLi+8OWXgQahpvAdNutdHrFBlCFBK2tdHkFBlhKgY1geAWUWeFVvtdp:C8EQPNeWgFeqdXj
                                                                          MD5:F07A3A86362E9E253BE91F59714FE134
                                                                          SHA1:84DE1AB2EAE62E4B114F0E613BD94955AFA9E6C7
                                                                          SHA-256:E199CC9C429B35A09721D0A22543C3729E2B8462E68DFA158C0CEC9C70A0D79D
                                                                          SHA-512:324EAF9F857076CA4FECB26D8DF76F8BB1D3F15EAE55D6B6C9689BF1682B306AC7A3592B6A518D23F9FE4DC21EFB6ACF1ECA948F889FA1ADFFA0E12C0BEAB57F
                                                                          Malicious:false
                                                                          Preview:#..# Aqua theme (OSX native look and feel)..#....namespace eval ttk::theme::aqua {.. ttk::style theme settings aqua {.....ttk::style configure . \... -font TkDefaultFont \... -background systemWindowBackgroundColor \... -foreground systemLabelColor \... -selectbackground systemSelectedTextBackgroundColor \... -selectforeground systemSelectedTextColor \... -selectborderwidth 0 \... -insertwidth 1.....ttk::style map . \... -foreground {....disabled systemDisabledControlTextColor....background systemLabelColor} \... -selectbackground {....background systemSelectedTextBackgroundColor....!focus systemSelectedTextBackgroundColor} \... -selectforeground {....background systemSelectedTextColor....!focus systemSelectedTextColor}.....# Button...ttk::style configure TButton -anchor center -width -6 \... -foreground systemControlTextColor...ttk::style map TButton \... -foreground {....pressed white... {alternate !pressed !background} white}...ttk::styl

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\button.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3014
                                                                          Entropy (8bit):4.917794267131833
                                                                          Encrypted:false
                                                                          SSDEEP:48:A5N+EqJWR1eTC01cG61ELLgrDgk1JgQ6TQGvhV5giT6TUP+3JWMHTeJ:kN+RQfccG61ooDgQ6dNT6TUP+PHO
                                                                          MD5:D4BF1AF5DCDD85E3BD11DBF52EB2C146
                                                                          SHA1:B1691578041319E671D31473A1DD404855D2038B
                                                                          SHA-256:E38A9D1F437981AA6BF0BDD074D57B769A4140C0F7D9AFF51743FE4ECC6DFDDF
                                                                          SHA-512:25834B4B231F4FF1A88EEF67E1A102D1D0546EC3B0D46856258A6BE6BBC4B381389C28E2EB60A01FF895DF24D6450CD16CA449C71F82BA53BA438A4867A47DCD
                                                                          Malicious:false
                                                                          Preview:#..# Bindings for Buttons, Checkbuttons, and Radiobuttons...#..# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed"..# state; widgets remain "active" if the pointer is dragged out...# This doesn't seem to be conventional, but it's a nice way..# to provide extra feedback while the grab is active...# (If the button is released off the widget, the grab deactivates and..# we get a <Leave> event then, which turns off the "active" state)..#..# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are..# delivered to the widget which received the initial <Button>..# event. However, Tk [grab]s (#1223103) and menu interactions..# (#1222605) can interfere with this. To guard against spurious..# <Button1-Enter> events, the <Button1-Enter> binding only sets..# the pressed state if the button is currently active...#....namespace eval ttk::button {}....bind TButton <Enter> ..{ %W instate !disabled {%W state active} }..bind TButton <Leave>..{ %W state !active }..bind TButton <s

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\clamTheme.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4809
                                                                          Entropy (8bit):4.905115353394083
                                                                          Encrypted:false
                                                                          SSDEEP:48:KrS4se/XhW03cC7TxPp/uo1ZUb0WZvSoetCgV+tMWG3xT3xgNB4x76FAuoxVYuIJ:oS4sSjWwFAGkhiP3xT3xL6B2bbe
                                                                          MD5:2B20E7B2E6BDDBEB14F5F63BF38DBF24
                                                                          SHA1:43DB48094C4BD7DE3B76AFBC051D887FEFE9887E
                                                                          SHA-256:CFFC59931FDD1683AD23895E92522CF49B099128753FCDFF34374024E42CF995
                                                                          SHA-512:1EB5EA78D26D18EAD6563AFBF1798F71723001DCC945E7DB3E4368564D0563029BE3565876AD8CB97331CFE34B2A0A313FA1BF252B87049160FE5DCD65434775
                                                                          Malicious:false
                                                                          Preview:#..# "Clam" theme...#..# Inspired by the XFCE family of Gnome themes...#....namespace eval ttk::theme::clam {.. variable colors.. array set colors {...-disabledfg.."#999999"...-frame .."#dcdad5"...-window .."#ffffff"...-dark..."#cfcdc8"...-darker .."#bab5ab"...-darkest.."#9e9a91"...-lighter.."#eeebe7"...-lightest .."#ffffff"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-altindicator.."#5895bc"...-disabledaltindicator."#a0a0a0".. }.... ttk::style theme settings clam {.....ttk::style configure "." \... -background $colors(-frame) \... -foreground black \... -bordercolor $colors(-darkest) \... -darkcolor $colors(-dark) \... -lightcolor $colors(-lighter) \... -troughcolor $colors(-darker) \... -selectbackground $colors(-selectbg) \... -selectforeground $colors(-selectfg) \... -selectborderwidth 0 \... -font TkDefaultFont \... ;.....ttk::style map "." \... -background [list disabled $colors(-frame) \..... active $colors(-lighter)] \..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\classicTheme.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3864
                                                                          Entropy (8bit):4.935603001745302
                                                                          Encrypted:false
                                                                          SSDEEP:48:zcJZjdWs+WVB4ULsMF7tnvnuSuqo5DKxiFgG0FgGHx9FrGTtu/3Kt+iW2PbuAk38:zcJZEstB4UoituSm+VtYErY
                                                                          MD5:0205663142775F4EF2EB104661D30979
                                                                          SHA1:452A0D613288A1CC8A1181C3CC1167E02AA69A73
                                                                          SHA-256:424BBA4FB6836FEEBE34F6C176ED666DCE51D2FBA9A8D7AA756ABCBBAD3FC1E3
                                                                          SHA-512:FB4D212A73A6F5A8D2774F43D310328B029B52B35BEE133584D8326363B385AB7AA4AE25E98126324CC716962888321E0006E5F6EF8563919A1D719019B2D117
                                                                          Malicious:false
                                                                          Preview:#..# "classic" Tk theme...#..# Implements Tk's traditional Motif-like look and feel...#....namespace eval ttk::theme::classic {.... variable colors; array set colors {...-frame.."#d9d9d9"...-window.."#ffffff"...-activebg."#ececec"...-troughbg."#c3c3c3"...-selectbg."#c3c3c3"...-selectfg."#000000"...-disabledfg."#a3a3a3"...-indicator."#b03060"...-altindicator."#b05e5e".. }.... ttk::style theme settings classic {...ttk::style configure "." \... -font..TkDefaultFont \... -background..$colors(-frame) \... -foreground..black \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -troughcolor.$colors(-troughbg) \... -indicatorcolor.$colors(-frame) \... -highlightcolor.$colors(-frame) \... -highlightthickness.1 \... -selectborderwidth.1 \... -insertwidth.2 \... ;.....# To match pre-Xft X11 appearance, use:...#.ttk::style configure . -font {Helvetica 12 bold}.....ttk::style map "." -background \... [list disabled

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\combobox.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):12718
                                                                          Entropy (8bit):5.063548300335668
                                                                          Encrypted:false
                                                                          SSDEEP:192:otLzBJ9SfinaXUBLPYXlk7fKiLH+AzIoJdJwGknmyLsxoVEQGITse8g5sarkT32e:wB5aXmLPYXmrKxLL7A
                                                                          MD5:F7065D345A4BFB3127C3689BF1947C30
                                                                          SHA1:9631C05365B0F5A36E4CA5CBA83628CCD7FCBDE1
                                                                          SHA-256:68EED4AF6D2EC5B3EA24B1122A704B040366CBE2F458103137479352FFA1475A
                                                                          SHA-512:74B99B9E326680150DD5EC7263192691BCD8A71B2A4EE7F3177DEDDD43E924A7925085C6D372731A70570F96B3924450255B2F54CA3B9C44D1160CA37E715B00
                                                                          Malicious:false
                                                                          Preview:#..# Combobox bindings...#..# <<NOTE-WM-TRANSIENT>>:..#..#.Need to set [wm transient] just before mapping the popdown..#.instead of when it's created, in case a containing frame..#.has been reparented [#1818441]...#..#.On Windows: setting [wm transient] prevents the parent..#.toplevel from becoming inactive when the popdown is posted..#.(Tk 8.4.8+)..#..#.On X11: WM_TRANSIENT_FOR on override-redirect windows..#.may be used by compositing managers and by EWMH-aware..#.window managers (even though the older ICCCM spec says..#.it's meaningless)...#..#.On OSX: [wm transient] does utterly the wrong thing...#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]...#.The "noActivates" attribute prevents the parent toplevel..#.from deactivating when the popdown is posted, and is also..#.necessary for "help" windows to receive mouse events...#."hideOnSuspend" makes the popdown disappear (resp. reappear)..#.when the parent toplevel is deactivated (resp. reactivated)...#.(see [#18147

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\cursors.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4827
                                                                          Entropy (8bit):4.843146795750702
                                                                          Encrypted:false
                                                                          SSDEEP:96:DRYEqfLDxGmxGUz4GUtaPT6t6brv0q3O4Uu0:DWEqTDbxdWaPqe5PUr
                                                                          MD5:18EC3E60B8DD199697A41887BE6CE8C2
                                                                          SHA1:13FF8CE95289B802A5247B1FD9DEA90D2875CB5D
                                                                          SHA-256:7A2ED9D78FABCAFFF16694F2F4A2E36FF5AA313F912D6E93484F3BCD0466AD91
                                                                          SHA-512:4848044442EFE75BCF1F89D8450C8ECBD441F38A83949A3CD2A56D9000CACAA2EA440CA1B32C856AB79358ACE9C7E3F70DDF0EC54AA93866223D8FEF76930B19
                                                                          Malicious:false
                                                                          Preview:#..# Map symbolic cursor names to platform-appropriate cursors...#..# The following cursors are defined:..#..#.standard.-- default cursor for most controls..#.""..-- inherit cursor from parent window..#.none..-- no cursor..#..#.text..-- editable widgets (entry, text)..#.link..-- hyperlinks within text..#.crosshair.-- graphic selection, fine control..#.busy..-- operation in progress..#.forbidden.-- action not allowed..#..#.hresize..-- horizontal resizing..#.vresize..-- vertical resizing..#..# Also resize cursors for each of the compass points,..# {nw,n,ne,w,e,sw,s,se}resize...#..# Platform notes:..#..# Windows doesn't distinguish resizing at the 8 compass points,..# only horizontal, vertical, and the two diagonals...#..# OSX doesn't have resize cursors for nw, ne, sw, or se corners...# We use the Tk-defined X11 fallbacks for these...#..# X11 doesn't have a "forbidden" cursor (usually a slashed circle);..# "pirate" seems to be the conventional cursor for this purpose...#..# Windows has a

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\defaults.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4553
                                                                          Entropy (8bit):4.933885986949396
                                                                          Encrypted:false
                                                                          SSDEEP:96:lNl3u3lCFUeuMGN3xbVJU+N3xbVJh3IwxkxlBqatUrtY:zl3ZUe9GN3NVC+N3NVjqntUZY
                                                                          MD5:FC79F42761D63172163C08F0F5C94436
                                                                          SHA1:AABAB4061597D0D6DC371F46D14AAA1A859096DF
                                                                          SHA-256:49AE8FAF169165BDDAF01D50B52943EBAB3656E9468292B7890BE143D0FCBC91
                                                                          SHA-512:F619834A95C9DEB93F8184BCC437D701A961C77E24A831ADBD5C145556D26986BFDA2A6ACB9E8784F8B2380E122D12AC893EB1B6ACF03098922889497E1FF9EA
                                                                          Malicious:false
                                                                          Preview:#..# Settings for default theme...#....namespace eval ttk::theme::default {.. variable colors.. array set colors {...-frame..."#d9d9d9"...-foreground.."#000000"...-window..."#ffffff"...-text .."#000000"...-activebg.."#ececec"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-darker .."#c3c3c3"...-disabledfg.."#a3a3a3"...-indicator.."#4a6984"...-disabledindicator."#a3a3a3"...-altindicator.."#9fbdd8"...-disabledaltindicator."#c0c0c0".. }.... ttk::style theme settings default {.....ttk::style configure "." \... -borderwidth .1 \... -background .$colors(-frame) \... -foreground .$colors(-foreground) \... -troughcolor .$colors(-darker) \... -font ..TkDefaultFont \... -selectborderwidth.1 \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -insertwidth .1 \... -indicatordiameter.10 \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)]...ttk::style map "."

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\entry.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):17617
                                                                          Entropy (8bit):5.025882547402842
                                                                          Encrypted:false
                                                                          SSDEEP:384:sca9JzOyzf6yzwO+v+iPT3vKof8q3YIuR13a:sT9JzOy76wiV3YNa
                                                                          MD5:89089172393C551CD1668B9C19B88290
                                                                          SHA1:0B8667217A4A14289E9F6C1B384DEF5479BCA089
                                                                          SHA-256:830CC3009A735E92DB70D53210C4928DD35CAAB5051ED14DEC67E06AE25CBE28
                                                                          SHA-512:ABBBE6AA937AAB392BC7DCB8BBFBBEC9EE5ED2C9F10ED982D77258BD98F27EE95AC47FD7CB6761B814885EF0878E1F1557D034C9F4163D9D85B388F2B837683F
                                                                          Malicious:false
                                                                          Preview:#..# DERIVED FROM: tk/library/entry.tcl r1.22..#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 2004, Joe English..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ttk {.. namespace eval entry {...variable State.....set State(x) 0...set State(selectMode) none...set State(anchor) 0...set State(scanX) 0...set State(scanIndex) 0...set State(scanMoved) 0.....# Button-2 scan speed is (scanNum/scanDen) characters...# per pixel of mouse movement....# The standard Tk entry widget uses the equivalent of...# scanNum = 10, scanDen = average character width....# I don't know why that was chosen....#...set State(scanNum) 1...set State(scanDen) 1...set State(deadband) 3.;# #pixels for mouse-moved deadband... }..}....### Option database settings...#..option add *TEntry.cursor [ttk::cursor text] widg

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\fonts.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5732
                                                                          Entropy (8bit):5.001928619185109
                                                                          Encrypted:false
                                                                          SSDEEP:96:NzEh94ntnVU8Z/1LkAKgW22SeLMQR8hzcksejmOF4ytZm:Sh9ahV3ZWAKgWDfktm
                                                                          MD5:80331FCBE4C049FF1A0D0B879CB208DE
                                                                          SHA1:4EB3EFDFE3731BD1AE9FD52CE32B1359241F13CF
                                                                          SHA-256:B94C319E5A557A5665B1676D602B6495C0887C5BACF7FA5B776200112978BB7B
                                                                          SHA-512:A4BD2D91801C121A880225F1F3D0C4E30BF127190CF375F6F7A49EB4239A35C49C44F453D6D3610DF0D6A7B3CB15F4E79BD9C129025CC496CEB856FCC4B6DE87
                                                                          Malicious:false
                                                                          Preview:#..# Font specifications...#..# This file, [source]d at initialization time, sets up the following..# symbolic fonts based on the current platform:..#..# TkDefaultFont.-- default for GUI items not otherwise specified..# TkTextFont.-- font for user text (entry, listbox, others)..# TkFixedFont.-- standard fixed width font..# TkHeadingFont.-- headings (column headings, etc)..# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.)..# TkTooltipFont.-- font to use for tooltip windows..# TkIconFont.-- font to use for icon captions..# TkMenuFont.-- used to use for menu items..#..# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation..# (On Windows and Mac OS X as of Oct 2007)...#..# +++ Platform notes:..#..# Windows:..#.The default system font changed from "MS Sans Serif" to "Tahoma"..# .in Windows XP/Windows 2000...#..#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,..#.although many MS programs still use "MS Sans Serif 8"..#..#.Should use

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\menubutton.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):6641
                                                                          Entropy (8bit):4.923865616450888
                                                                          Encrypted:false
                                                                          SSDEEP:192:toMcJQkmcE6fNuLyiCpYSmFSRwgppdT3kXdpK3dpKkNf2tOTjvAG:tRc6kFbcz2pyXz+zZ2y
                                                                          MD5:4C8D90257D073F263B258F00B2A518C2
                                                                          SHA1:7B58859E9B70FB37F53809CD3FFD7CF69AB310D8
                                                                          SHA-256:972B13854D0E9B84DE338D6753F0F11F3A8534E7D0E51838796DAE5A1E2E3085
                                                                          SHA-512:ED67F41578EE834EE8DB1FDED8AA069C0045E7058E338C451FA8E1ADE52907BED0C95631C21B8E88461571903B3DA2698A29E47F990B7A0F0DD3073E7A1BCADC
                                                                          Malicious:false
                                                                          Preview:#..# Bindings for Menubuttons...#..# Menubuttons have three interaction modes:..#..# Pulldown: Press menubutton, drag over menu, release to activate menu entry..# Popdown: Click menubutton to post menu..# Keyboard: <space> or accelerator key to post menu..#..# (In addition, when menu system is active, "dropdown" -- menu posts..# on mouse-over. Ttk menubuttons don't implement this)...#..# For keyboard and popdown mode, we hand off to tk_popup and let..# the built-in Tk bindings handle the rest of the interaction...#..# ON X11:..#..# Standard Tk menubuttons use a global grab on the menubutton...# This won't work for Ttk menubuttons in pulldown mode,..# since we need to process the final <ButtonRelease> event,..# and this might be delivered to the menu. So instead we..# rely on the passive grab that occurs on <Button> events,..# and transition to popdown mode when the mouse is released..# or dragged outside the menubutton...#..# ON WINDOWS:..#..# I'm not sure what the hell is going on h

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\notebook.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5825
                                                                          Entropy (8bit):4.96378772387536
                                                                          Encrypted:false
                                                                          SSDEEP:96:RErUhyi5JeUQBWdz6eP8ClR6/u6AsBmPNNiREUkheLY1EVL23sN2JJjQdD:6uyiyDQBP8q6/u6AUREUsNEVq3y2jkdD
                                                                          MD5:F811F3E46A4EFA73292F40D1CDDD265D
                                                                          SHA1:7FC70A1984555672653A0840499954B854F27920
                                                                          SHA-256:22264D8D138E2C0E9A950305B4F08557C5A73F054F8215C0D8CE03854042BE76
                                                                          SHA-512:4424B7C687EB9B1804ED3B1C685F19D4D349753B374D9046240F937785C9713E8A760ADA46CB628C15F9C7983CE4A7987691C968330478C9C1A9B74E953E40AC
                                                                          Malicious:false
                                                                          Preview:#..# Bindings for TNotebook widget..#....namespace eval ttk::notebook {.. variable TLNotebooks ;# See enableTraversal..}....bind TNotebook <Button-1>..{ ttk::notebook::Press %W %x %y }..bind TNotebook <Right>...{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Left>...{ ttk::notebook::CycleTab %W -1; break }..bind TNotebook <Control-Tab>..{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Control-Shift-Tab>.{ ttk::notebook::CycleTab %W -1; break }..catch {..bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }..}..bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }....# ActivateTab $nb $tab --..#.Select the specified tab and set focus...#..# Desired behavior:..#.+ take focus when reselecting the currently-selected tab;..#.+ keep focus if the notebook already has it;..#.+ otherwise set focus to the first traversable widget..#. in the newly-selected tab;..#.+ do not leave the focus in a deselected tab...#..proc ttk::notebook::ActivateTab {

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\panedwindow.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2290
                                                                          Entropy (8bit):4.948496148661722
                                                                          Encrypted:false
                                                                          SSDEEP:48:zVAqE3ZF8b4rXzsqALAXsmCLFeNqkFeNXLz:zLeU4bzNs1h
                                                                          MD5:619D8F54EE73AD8A373AB272FBDB94A6
                                                                          SHA1:973626B5396B7E786DEDD8159D10E66B4465F9E0
                                                                          SHA-256:4D08A7E29EEF731876951EF01DFA51654B6275FA3DAADB1F48FF4BBEAC238EB5
                                                                          SHA-512:0D913C7DC9DAEE2B4A2A46663A07B3139D6B8F30D2F942642817504535E85616835EAA7D468851A83723A3DD711B65761376F3DF96A59A933A74EF096E13ACE9
                                                                          Malicious:false
                                                                          Preview:#..# Bindings for ttk::panedwindow widget...#....namespace eval ttk::panedwindow {.. variable State.. array set State {...pressed 0.. .pressX.-...pressY.-...sash .-...sashPos -.. }..}....## Bindings:..#..bind TPanedwindow <Button-1> ..{ ttk::panedwindow::Press %W %x %y }..bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }..bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }....bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }..# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>..bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }....## Sash movement:..#..proc ttk::panedwindow::Press {w x y} {.. variable State.... set sash [$w identify $x $y].. if {$sash eq ""} {.. .set State(pressed) 0...return.. }.. set State(pressed) .1.. set State(pressX) .$x.. set

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\progress.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1138
                                                                          Entropy (8bit):4.763501917862434
                                                                          Encrypted:false
                                                                          SSDEEP:24:nJ8v3O0NSiio0pNFVkIks0ImxlnINgDImSgGINSyWghT:JFqS/o03fkxs0Rn+gD4v+S2F
                                                                          MD5:DBF3BF0E8F04E9435E9561F740DFC700
                                                                          SHA1:C7619A05A834EFB901C57DCFEC2C9E625F42428F
                                                                          SHA-256:697CC0A75AE31FE9C2D85FB25DCA0AFA5D0DF9C523A2DFAD2E4A36893BE75FBA
                                                                          SHA-512:D3B323DFB3EAC4A78DA2381405925C131A99C6806AF6FD8041102162A44E48BF166982A4AE4AA142A14601736716F1A628D9587E292FA8E4842BE984374CC192
                                                                          Malicious:false
                                                                          Preview:#..# Ttk widget set: progress bar utilities...#....namespace eval ttk::progressbar {.. variable Timers.;# Map: widget name -> after ID..}....# Autoincrement --..#.Periodic callback procedure for autoincrement mode..#..proc ttk::progressbar::Autoincrement {pb steptime stepsize} {.. variable Timers.... if {![winfo exists $pb]} {.. .# widget has been destroyed -- cancel timer...unset -nocomplain Timers($pb)...return.. }.... set Timers($pb) [after $steptime \.. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].... $pb step $stepsize..}....# ttk::progressbar::start --..#.Start autoincrement mode. Invoked by [$pb start] widget code...#..proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {.. variable Timers.. if {![info exists Timers($pb)]} {...Autoincrement $pb $steptime $stepsize.. }..}....# ttk::progressbar::stop --..#.Cancel autoincrement mode. Invoked by [$pb stop] widget code...#..proc ttk::progressbar::stop {pb} {.. variabl

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\scale.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2787
                                                                          Entropy (8bit):4.795451191784129
                                                                          Encrypted:false
                                                                          SSDEEP:48:IKADAzizZIcAlRqucObmn4AzyVN2AJyhAzukPNP:IHIBRqupmLSZkklP
                                                                          MD5:F1C33CC2D47115BBECD2E7C2FCB631A7
                                                                          SHA1:0123A961242ED8049B37C77C726DB8DBD94C1023
                                                                          SHA-256:B909ADD0B87FA8EE08FD731041907212A8A0939D37D2FF9B2F600CD67DABD4BB
                                                                          SHA-512:96587A8C3555DA1D810010C10C516CE5CCAB071557A3C8D9BD65C647C7D4AD0E35CBED0788F1D72BAFAC8C84C7E2703FC747F70D9C95F720745A1FC4A701C544
                                                                          Malicious:false
                                                                          Preview:# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# Bindings for the TScale widget....namespace eval ttk::scale {.. variable State.. array set State {...dragging 0.. }..}....bind TScale <Button-1> { ttk::scale::Press %W %x %y }..bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }....bind TScale <Button-2> { ttk::scale::Jump %W %x %y }..bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }....bind TScale <Button-3> { ttk::scale::Jump %W %x %y }..bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }....## Keyboard navigation bindings:..#..bind TScale <<LineStart>> { %W set [%W cget -from] }..bind TScale <<LineEnd>> { %W set [%W cget -to] }....bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }..bin

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\scrollbar.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):3285
                                                                          Entropy (8bit):4.979174619784594
                                                                          Encrypted:false
                                                                          SSDEEP:48:tyASEji8RYQ8FGD7BDos9Q1TBfvq/HKTh9lkHv8T/mAezeLEAAFULxZh4x:eIi8qFu2d11XlhfkPcczeLS4Zm
                                                                          MD5:3FB31A225CEC64B720B8E579582F2749
                                                                          SHA1:9C0151D9E2543C217CF8699FF5D4299A72E8F13C
                                                                          SHA-256:6EAA336B13815A7FC18BCD6B9ADF722E794DA2888D053C229044784C8C8E9DE8
                                                                          SHA-512:E6865655585E3D2D6839B56811F3FD86B454E8CD44E258BB1AC576AD245FF8A4D49FBB7F43458BA8A6C9DAAC8DFA923A176F0DD8A9976A11BEA09E6E2D17BF45
                                                                          Malicious:false
                                                                          Preview:#..# Bindings for TScrollbar widget..#....namespace eval ttk::scrollbar {.. variable State.. # State(xPress).--.. # State(yPress).-- initial position of mouse at start of drag... # State(first).-- value of -first at start of drag...}....bind TScrollbar <Button-1> ..{ ttk::scrollbar::Press %W %x %y }..bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }....bind TScrollbar <Button-2> ..{ ttk::scrollbar::Jump %W %x %y }..bind TScrollbar <B2-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-2>.{ ttk::scrollbar::Release %W %x %y }....# Redirect scrollwheel bindings to the scrollbar widget..#..# The shift-bindings scroll left/right (not up/down)..# if a widget has both possibilities..set eventList [list <MouseWheel> <Shift-MouseWheel>]..switch [tk windowingsystem] {.. aqua {.. lappend eventList <Option-MouseWheel> <Shift-Option-MouseWheel>.. }.. x11 {..

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\sizegrip.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2503
                                                                          Entropy (8bit):4.830288003879418
                                                                          Encrypted:false
                                                                          SSDEEP:48:naLvMnAqeYQWYh7FvBrrbnMCfY/aVAbAigWAuFM0PfWAX20:nWQapprPnJY/8A8iRFdPtj
                                                                          MD5:DD6A1737B14D3F7B2A0B4F8BE99C30AF
                                                                          SHA1:E6B06895317E73CD3DC78234DD74C74F3DB8C105
                                                                          SHA-256:E92D77B5CDCA2206376DB2129E87E3D744B3D5E31FDE6C0BBD44A494A6845CE1
                                                                          SHA-512:B74AE92EDD53652F8A3DB0D84C18F9CE9069805BCAB0D3C2DBB537D7C241AA2681DA69B699D88A10029798D7B5BC015682F64699BA475AE6A379EEF23B48DAAF
                                                                          Malicious:false
                                                                          Preview:#..# Sizegrip widget bindings...#..# Dragging a sizegrip widget resizes the containing toplevel...#..# NOTE: the sizegrip widget must be in the lower right hand corner...#....switch -- [tk windowingsystem] {.. x11 -.. win32 {...option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault.. }.. aqua {.. .# Aqua sizegrips use default Arrow cursor... }..}....namespace eval ttk::sizegrip {.. variable State.. array set State {...pressed .0...pressX ..0...pressY ..0...width ..0...height ..0...widthInc.1...heightInc.1.. resizeX 1.. resizeY 1...toplevel .{}.. }..}....bind TSizegrip <Button-1> ..{ ttk::sizegrip::Press.%W %X %Y }..bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }..bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }....proc ttk::sizegrip::Press {W X Y} {.. variable State.... if {[$W instate disabled]} { return }.... set top [winfo toplevel $W].... # If the toplevel is not resi

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\spinbox.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):5003
                                                                          Entropy (8bit):5.055050310142795
                                                                          Encrypted:false
                                                                          SSDEEP:96:1qg/+yrjqA/K5ytxm1J1Ve6J1yQLUAzz/S76hrwxGGe2F:N/+yr2Gk1J1Ve6fxUAzDS76hrwxs2F
                                                                          MD5:9C2833FAA9248F09BC2E6AB1BA326D59
                                                                          SHA1:F13CF048FD706BBB1581DC80E33D1AAD910D93E8
                                                                          SHA-256:DF286BB59F471AA1E19DF39AF0EF7AA84DF9F04DC4A439A747DD8BA43C300150
                                                                          SHA-512:5FF3BE1E3D651C145950C3FC5B8C2E842211C937D1042173964383D4D59ECF5DD0EC39FF7771D029716F2D895F0B1A72591EF3BF7947FE64D4D6DB5F0B8ABFFB
                                                                          Malicious:false
                                                                          Preview:#..# ttk::spinbox bindings..#....namespace eval ttk::spinbox { }....### Spinbox bindings...#..# Duplicate the Entry bindings, override if needed:..#....ttk::copyBindings TEntry TSpinbox....bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }..bind TSpinbox <Button-1> ..{ ttk::spinbox::Press %W %x %y }..bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }..bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }..bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click....bind TSpinbox <Up>...{ event generate %W <<Increment>> }..bind TSpinbox <Down> ...{ event generate %W <<Decrement>> }....bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }..bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }....ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]....## Motion --..#.Sets cursor...#..proc ttk::spinbox::Motion {w x y} {.. variable State.. ttk::saveCursor $w State(userConfCursor) [ttk::cursor text].. if { [$w ide

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\treeview.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):10180
                                                                          Entropy (8bit):4.886259798213254
                                                                          Encrypted:false
                                                                          SSDEEP:96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
                                                                          MD5:F705B3A292D02061DA0ABB4A8DD24077
                                                                          SHA1:FD75C2250F6F66435444F7DEEF383C6397ED2368
                                                                          SHA-256:C88B60FFB0F72E095F6FC9786930ADD7F9ED049EABC713F889F9A7DA516E188C
                                                                          SHA-512:09817638DD3D3D5C57FA630C7EDF2F19C3956C9BD264DBF07627FA14A03AECD22D5A5319806E49EF1030204FADEF17C57CE8EAE4378A319AD2093321D9151C8F
                                                                          Malicious:false
                                                                          Preview:#..# ttk::treeview widget bindings and utilities...#....namespace eval ttk::treeview {.. variable State.... # Enter/Leave/Motion.. #.. set State(activeWidget) .{}.. set State(activeHeading) .{}.... # Press/drag/release:.. #.. set State(pressMode) .none.. set State(pressX)..0.... # For pressMode == "resize".. set State(resizeColumn).#0.... # For pressmode == "heading".. set State(heading) .{}..}....### Widget bindings...#....bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }..bind Treeview.<B1-Leave>..{ #nothing }..bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}..bind Treeview.<Button-1> ..{ ttk::treeview::Press %W %x %y }..bind Treeview.<Double-Button-1> .{ ttk::treeview::DoubleClick %W %x %y }..bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }..bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }..bind Treeview .<Up> ..{ ttk::treeview::Keynav %W up }..bind Treeview .<Down> ..{ ttk::treeview

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\ttk.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):4993
                                                                          Entropy (8bit):4.954034141173847
                                                                          Encrypted:false
                                                                          SSDEEP:96:lfxukTy5jPTq8LIgF2diyNTNR6nkrn4ijSSvNigyJ5612HtZG835MSvWOTRsHWU:BM+y5jrq8G/2nkEijSSvNigyJ5612Htw
                                                                          MD5:AF45B2C8B43596D1BDECA5233126BD14
                                                                          SHA1:A99E75D299C4579E10FCDD59389B98C662281A26
                                                                          SHA-256:2C48343B1A47F472D1A6B9EE8D670CE7FB428DB0DB7244DC323FF4C7A8B4F64B
                                                                          SHA-512:C8A8D01C61774321778AB149F6CA8DDA68DB69133CB5BA7C91938E4FD564160ECDCEC473222AFFB241304A9ACC73A36B134B3A602FD3587C711F2ADBB64AFA80
                                                                          Malicious:false
                                                                          Preview:#..# Ttk widget set initialization script...#....### Source library scripts...#....namespace eval ::ttk {.. variable library.. if {![info exists library]} {...set library [file dirname [info script]].. }..}....source -encoding utf-8 [file join $::ttk::library fonts.tcl]..source -encoding utf-8 [file join $::ttk::library cursors.tcl]..source -encoding utf-8 [file join $::ttk::library utils.tcl]....## ttk::deprecated $old $new --..#.Define $old command as a deprecated alias for $new command..#.$old and $new must be fully namespace-qualified...#..proc ttk::deprecated {old new} {.. interp alias {} $old {} ttk::do'deprecate $old $new..}..## do'deprecate --..#.Implementation procedure for deprecated commands --..#.issue a warning (once), then re-alias old to new...#..proc ttk::do'deprecate {old new args} {.. deprecated'warning $old $new.. interp alias {} $old {} $new.. uplevel 1 [linsert $args 0 $new]..}....## deprecated'warning --..#.Gripe about use of deprecated comman

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\utils.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):8624
                                                                          Entropy (8bit):5.001791071900077
                                                                          Encrypted:false
                                                                          SSDEEP:192:e0ebpSp+IZwnmTmpx8xzaHfw8K7LVJWQl8p7M+R5:rw0+WmpWxa/w9nVJHu
                                                                          MD5:D98EDC491DA631510F124CD3934F535F
                                                                          SHA1:33037A966067C9F5C9074AE5532FF3B51B4082D4
                                                                          SHA-256:D58610A34301BB6E61A60BEC69A7CECF4C45C6A034A9FC123977174B586278BE
                                                                          SHA-512:23FAED8298E561F490997FE44AB61CD8CCB9F1F63D48BB4CF51FC9E591E463FF9297973622180D6A599CABB541C82B8FE33BF38A82C5D5905BBFA52CA0341399
                                                                          Malicious:false
                                                                          Preview:#..# Utilities for widget implementations...#....### Focus management...#..# See also: #1516479..#....## ttk::takefocus --..#.This is the default value of the "-takefocus" option..#.for ttk::* widgets that participate in keyboard navigation...#..# NOTES:..#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable]..#.if -takefocus is 1, empty, or missing; but not if it's a..#.script prefix, so we have to check that here as well...#..#..proc ttk::takefocus {w} {.. expr {[$w instate !disabled] && [winfo viewable $w]}..}....## ttk::GuessTakeFocus --..#.This routine is called as a fallback for widgets..#.with a missing or empty -takefocus option...#..#.It implements the same heuristics as tk::FocusOK...#..proc ttk::GuessTakeFocus {w} {.. # Don't traverse to widgets with '-state disabled':.. #.. if {![catch {$w cget -state} state] && $state eq "disabled"} {...return 0.. }.... # Allow traversal to widgets with explicit key or focus bindings:.. #.. if {[regexp {Key|F

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\vistaTheme.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):9710
                                                                          Entropy (8bit):4.6639701588183895
                                                                          Encrypted:false
                                                                          SSDEEP:192:BktY1F+qXd95WSZaHFHRE3GRKFh2oaoT/ezKpqvYMHab:V1F+cd95WSZuhRE34KbPmKmY2ab
                                                                          MD5:0AA7F8B43C3E07F3A4DA07FC6DF9A1B0
                                                                          SHA1:153AFB735B10BBA16CFBE161777232F983845D90
                                                                          SHA-256:EC5F203C69DF390E9B99944CF3526D6E77DC6F68E9B1A029F326A41AFED1EF81
                                                                          SHA-512:5406553211CD6714C98EF7765ABD46424CCB013343EFF693FDD3AE6E0AAE9B5983446E0E1CC706D6B2C285084BF83D397306D3D52028CBBCFB8F369857C5B69C
                                                                          Malicious:false
                                                                          Preview:#..# Settings for Microsoft Windows Vista and Server 2008..#....# The Vista theme can only be defined on Windows Vista and above. The theme..# is created in C due to the need to assign a theme-enabled function for..# detecting when themeing is disabled. On systems that cannot support the..# Vista theme, there will be no such theme created and we must not..# evaluate this script.....if {"vista" ni [ttk::style theme names]} {.. return..}....namespace eval ttk::theme::vista {.... ttk::style theme settings vista {.... .ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\winTheme.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2865
                                                                          Entropy (8bit):4.917847108902527
                                                                          Encrypted:false
                                                                          SSDEEP:48:b69VhW2gL5FPVWRzQsVqrEuF3yYrf7rfJF8xUqBgLt6g3ktO5jo4+iZ6O2htYtCW:bbXl+CEqZNNSxU0Ht2MR7W
                                                                          MD5:769C0719A4044F91E7D132A25291E473
                                                                          SHA1:6FB07B0C887D443A43FB15D5728920B578171219
                                                                          SHA-256:AE82BCCCE708FF9C303CBCB3D4CC3FF5577A60D5B23822EA79E3E07CCE3CBBD1
                                                                          SHA-512:47FED061DDC6B4EB63EF77901D0094FF2EBB1BAFACB3F44FBF13FB59DEA1EC83985B2862086ECF1A7957819A88A0FAA144B35F16BEA9356BBD9775070D42E636
                                                                          Malicious:false
                                                                          Preview:#..# Settings for 'winnative' theme...#....namespace eval ttk::theme::winnative {.. ttk::style theme settings winnative {.....ttk::style configure "." \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -fieldbackground SystemWindow \... -insertcolor SystemWindowText \... -troughcolor SystemScrollbar \... -font TkDefaultFont \... ;.....ttk::style map "." -foreground [list disabled SystemGrayText] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -relief raised -shiftrelief 1...ttk::style configure TCheckbutton -padding "2 4"...ttk::style configure TRadiobutton -padding "2 4"...ttk::style configure TMenubutton \... -padding "8 4" -arrowsize 3 -relief raised.....ttk::style map TButton -relief {{!disabled pressed} sunken}.....ttk::style configure TEntry \... -padding 2 -select

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\ttk\xpTheme.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):2103
                                                                          Entropy (8bit):4.9805308941424355
                                                                          Encrypted:false
                                                                          SSDEEP:48:aaiIu89VhW2gLRWJyO514rf+rfzxTrf/MW+iZ6O2htYtCp:XoXAk21nxQ7p
                                                                          MD5:162F30D2716438C75EA16B57E6F63088
                                                                          SHA1:3F626FF0496BB16B27106BED7E38D1C72D1E3E27
                                                                          SHA-256:AEDB21C6B2909A4BB4686837D2126E521A8CC2B38414A4540387B801EBD75466
                                                                          SHA-512:6EBF9648F1381D04F351BB469B6E3A38F3D002189C92EAF80A18D65632037FF37D34EC8814BBF7FAE34553645BFC13985212F24684EE8C4E205729B975C88C97
                                                                          Malicious:false
                                                                          Preview:#..# Settings for 'xpnative' theme..#....namespace eval ttk::theme::xpnative {.... ttk::style theme settings xpnative {.....ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::style configure TCheckbutton -padding 2...ttk::style configure TMenubutton -padding {8 4}.....ttk::style configure TNotebook -tabmargins {2 2 2 0}...ttk::style map TNotebook.Tab \... -expand [list selected {2 2 2 2}].....ttk::style configure TLabelframe.Label -foreground "#0046d5".....# OR: -padding {3 3 3 6}, which some apps seem to use....ttk::style configure TEntry -padding {2 2 2 4}...ttk::

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\unsupported.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):10521
                                                                          Entropy (8bit):5.0647027375963996
                                                                          Encrypted:false
                                                                          SSDEEP:192:1Y3uWEXm/swEePmJhRAXd1hTHsHG2ML/9Lm2daM0Hu:8hodMiM0Hu
                                                                          MD5:508F7E258C04970FAE526990168CB773
                                                                          SHA1:33785204B18C0E0F5CDCB5B49399B5907351FDB8
                                                                          SHA-256:B463B366F139DDF7FED31F34C6D2341F9F27845A1A358011DFC801E1333B1828
                                                                          SHA-512:A12985B58DD1D46297119CED47B7F44EF4139CED6C36FD028E66DD657E5ED0663B744C679A5BF7A39B39D17A32E1280D2945F6B9AD59AEF20436F68040F6070C
                                                                          Malicious:false
                                                                          Preview:# unsupported.tcl --..#..# Commands provided by Tk without official support. Use them at your..# own risk. They may change or go away without notice...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# ----------------------------------------------------------------------..# Unsupported compatibility interface for folks accessing Tk's private..# commands and variable against recommended usage...# ----------------------------------------------------------------------....namespace eval ::tk::unsupported {.... # Map from the old global names of Tk private commands to their.. # new namespace-encapsulated names..... variable PrivateCommands.. array set PrivateCommands {...tkButtonAutoInvoke..::tk::ButtonAutoInvoke...tkButtonDown...::tk::ButtonDown...tkButtonEnter...::tk::ButtonEnter...tkButtonInvoke...::tk::ButtonInvoke...tkButtonLeave...::tk::ButtonLeave...tkButtonUp...::tk::ButtonUp...tk

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\tk\xmfbox.tcl

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):27064
                                                                          Entropy (8bit):4.967626999005091
                                                                          Encrypted:false
                                                                          SSDEEP:384:0BLzjXhss64XP8FXm39QJ63nwFiHLgRIdNPCRE5phLtffsNP4XWdxWk+I5oy9jN7:0BvjXoivB3flLCRE5phLCP3xWV8veTod
                                                                          MD5:6DFD12DB27069F13957BC963EF5ACAAF
                                                                          SHA1:E492F0B60D73CE17C4FA7680BF0087DC5E0CC132
                                                                          SHA-256:1ED57E32CE9C419BCE36B483A91410DDF4C997CAF62D20E42048FC350F8C3F60
                                                                          SHA-512:32A3E205B4BC3B7D4D6F31E6FD26075EA3FAB7396F7392855D8BD4426CFEE9081482759EFF219038D64B074E2D3D864041E7C37DCA134F2A0C3140AA04D757C2
                                                                          Malicious:false
                                                                          Preview:# xmfbox.tcl --..#..#.Implements the "Motif" style file selection dialog for the..#.Unix platform. This implementation is used only if the..#."::tk_strictMotif" flag is set...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Scriptics Corporation..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}......# ::tk::MotifFDialog --..#..#.Implements a file dialog similar to the standard Motif file..#.selection box...#..# Arguments:..#.type.."open" or "save"..#.args..Options parsed by the procedure...#..# Results:..#.When -multiple is set to 0, this returns the absolute pathname..#.of the selected file. (NOTE: This is not the same as a single..#.element list.)..#..#.When -multiple is set to > 0, this returns a Tcl list of absolute..# pathnames. The argument for -multiple is ignored, but for consistency..#

                                                                          C:\Users\user\AppData\Local\Temp\_MEI10802\unicodedata.pyd

                                                                          Download File
                                                                          Process:C:\Users\user\Desktop\QuackMod.exe
                                                                          File Type:Unknown
                                                                          Category:dropped
                                                                          Size (bytes):1141016
                                                                          Entropy (8bit):5.435101785627634
                                                                          Encrypted:false
                                                                          SSDEEP:12288:3YPYbfjwR6nbkonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDqLo:3aYbMR0IDJcjEwPgPOG6Xyd46qLo
                                                                          MD5:D4323AC0BAAB59AED34C761F056D50A9
                                                                          SHA1:843687689D21EDE9818C6FC5F3772BCF914F8A6E
                                                                          SHA-256:71D27537EB1E6DE76FD145DA4FDCBC379DC54DE7854C99B2E61AAE00109C13D0
                                                                          SHA-512:E31D071CE920B3E83C89505DFA22B2D0F09D43C408FCADBC910F021481C4A53C47919FCE0215AE61F00956DCB7171449EABDA8EEF63A6FDD47AA13C7158577BE
                                                                          Malicious:false
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L..L..L..E.q.J..Y..N..Y..A..Y..D..Y..O..vE.O.....N..L.....vE.M..vE.M..vE..M..vE..M..RichL..........................PE..d....'ne.........." ...%.@..........P*....................................................`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................

                                                                          Static File Info

                                                                          General

                                                                          File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                          Entropy (8bit):7.9948646507688
                                                                          TrID:
                                                                          • Win64 Executable GUI (202006/5) 92.65%
                                                                          • Win64 Executable (generic) (12005/4) 5.51%
                                                                          • Generic Win/DOS Executable (2004/3) 0.92%
                                                                          • DOS Executable Generic (2002/1) 0.92%
                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                          File name:QuackMod.exe
                                                                          File size:12'093'721 bytes
                                                                          MD5:8402c65c2f1aeb6e797911f653e6b7e0
                                                                          SHA1:5c0ceb1c1e146a121b958d71456327fe09175f5c
                                                                          SHA256:ec4974127461dd4b05a83dea46e3f5c28620b3ff2a35189f3441a62c0b3e8efa
                                                                          SHA512:bb4f2c3bd97bad40ce77250861b7197cb06f4667295c10d2a2ff38c00f736ddd96b08b5b760399e1c3a9a41e65c4a11bcd0eb478e9e12c0af5d13baa7feb8688
                                                                          SSDEEP:196608:S458NjyQ1W903eV4QR24KF5ikWMWKACyNaA0W8/LV2ckT/OuPN58C1PC9e3O:4NjvW+eGQR2n/ikWMWLaHW8p2vZMCs9F
                                                                          TLSH:51C6338EB3560CE4FCEAC13BF186805696B2746602F5D58B57A4BC250B0B2E57E3EF11
                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?.......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?................

                                                                          File Icon

                                                                          Icon Hash:3761e8e0b2b26933

                                                                          Static PE Info

                                                                          General

                                                                          Entrypoint:0x14000c1f0
                                                                          Entrypoint Section:.text
                                                                          Digitally signed:false
                                                                          Imagebase:0x140000000
                                                                          Subsystem:windows gui
                                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                          Time Stamp:0x659B2D9A [Sun Jan 7 23:02:50 2024 UTC]
                                                                          TLS Callbacks:
                                                                          CLR (.Net) Version:
                                                                          OS Version Major:5
                                                                          OS Version Minor:2
                                                                          File Version Major:5
                                                                          File Version Minor:2
                                                                          Subsystem Version Major:5
                                                                          Subsystem Version Minor:2
                                                                          Import Hash:1af6c885af093afc55142c2f1761dbe8

                                                                          Entrypoint Preview

                                                                          Instruction
                                                                          dec eax
                                                                          sub esp, 28h
                                                                          call 00007FD43D264E2Ch
                                                                          dec eax
                                                                          add esp, 28h
                                                                          jmp 00007FD43D264A3Fh
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          dec eax
                                                                          sub esp, 28h
                                                                          call 00007FD43D2653A4h
                                                                          test eax, eax
                                                                          je 00007FD43D264BE3h
                                                                          dec eax
                                                                          mov eax, dword ptr [00000030h]
                                                                          dec eax
                                                                          mov ecx, dword ptr [eax+08h]
                                                                          jmp 00007FD43D264BC7h
                                                                          dec eax
                                                                          cmp ecx, eax
                                                                          je 00007FD43D264BD6h
                                                                          xor eax, eax
                                                                          dec eax
                                                                          cmpxchg dword ptr [0003427Ch], ecx
                                                                          jne 00007FD43D264BB0h
                                                                          xor al, al
                                                                          dec eax
                                                                          add esp, 28h
                                                                          ret
                                                                          mov al, 01h
                                                                          jmp 00007FD43D264BB9h
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          inc eax
                                                                          push ebx
                                                                          dec eax
                                                                          sub esp, 20h
                                                                          movzx eax, byte ptr [00034267h]
                                                                          test ecx, ecx
                                                                          mov ebx, 00000001h
                                                                          cmove eax, ebx
                                                                          mov byte ptr [00034257h], al
                                                                          call 00007FD43D2651A3h
                                                                          call 00007FD43D2662C2h
                                                                          test al, al
                                                                          jne 00007FD43D264BC6h
                                                                          xor al, al
                                                                          jmp 00007FD43D264BD6h
                                                                          call 00007FD43D273261h
                                                                          test al, al
                                                                          jne 00007FD43D264BCBh
                                                                          xor ecx, ecx
                                                                          call 00007FD43D2662D2h
                                                                          jmp 00007FD43D264BACh
                                                                          mov al, bl
                                                                          dec eax
                                                                          add esp, 20h
                                                                          pop ebx
                                                                          ret
                                                                          int3
                                                                          int3
                                                                          int3
                                                                          inc eax
                                                                          push ebx
                                                                          dec eax
                                                                          sub esp, 20h
                                                                          cmp byte ptr [0003421Ch], 00000000h
                                                                          mov ebx, ecx
                                                                          jne 00007FD43D264C29h
                                                                          cmp ecx, 01h
                                                                          jnbe 00007FD43D264C2Ch
                                                                          call 00007FD43D26530Ah
                                                                          test eax, eax
                                                                          je 00007FD43D264BEAh

                                                                          Data Directories

                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x3cdcc0x78.rdata
                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x460000x609c.rsrc
                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x420000x22a4.pdata
                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x4d0000x75c.reloc
                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x3a3300x1c.rdata
                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3a1f00x140.rdata
                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x420.rdata
                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                          Sections

                                                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                          .text0x10000x29c900x29e00False0.5523087686567164data6.4831047330596565IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                          .rdata0x2b0000x12bf40x12c00False0.5184375data5.8350063634273415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                          .data0x3e0000x33380xe00False0.1328125Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 01.8271683819747706IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                          .pdata0x420000x22a40x2400False0.4720052083333333data5.316391891279308IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                          _RDATA0x450000x15c0x200False0.38671875data2.83326547900447IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                          .rsrc0x460000x609c0x6200False0.9460299744897959data7.8997697514418075IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                          .reloc0x4d0000x75c0x800False0.5458984375data5.240127521097618IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                          Resources

                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                          RT_ICON0x461300x5782PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced1.0007142219444694
                                                                          RT_GROUP_ICON0x4b8b40x14data1.05
                                                                          RT_VERSION0x4b8c80x2c4data0.4675141242937853
                                                                          RT_MANIFEST0x4bb8c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                          Imports

                                                                          DLLImport
                                                                          USER32.dllCreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                          COMCTL32.dll
                                                                          KERNEL32.dllIsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                                          ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                          GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                          Network Behavior

                                                                          Network Port Distribution

                                                                          TCP Packets

                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Jan 13, 2024 04:58:22.363146067 CET497045353192.168.2.5143.42.125.232
                                                                          Jan 13, 2024 04:58:22.465606928 CET535349704143.42.125.232192.168.2.5
                                                                          Jan 13, 2024 04:58:22.465712070 CET497045353192.168.2.5143.42.125.232
                                                                          Jan 13, 2024 04:58:22.481838942 CET497045353192.168.2.5143.42.125.232
                                                                          Jan 13, 2024 04:58:22.584880114 CET535349704143.42.125.232192.168.2.5
                                                                          Jan 13, 2024 04:58:22.587480068 CET535349704143.42.125.232192.168.2.5
                                                                          Jan 13, 2024 04:58:22.587610960 CET535349704143.42.125.232192.168.2.5
                                                                          Jan 13, 2024 04:58:22.587645054 CET497045353192.168.2.5143.42.125.232
                                                                          Jan 13, 2024 04:58:22.587732077 CET497045353192.168.2.5143.42.125.232
                                                                          Jan 13, 2024 04:58:22.689044952 CET535349704143.42.125.232192.168.2.5

                                                                          UDP Packets

                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Jan 13, 2024 04:58:22.074131966 CET6390653192.168.2.51.1.1.1
                                                                          Jan 13, 2024 04:58:22.222240925 CET53639061.1.1.1192.168.2.5

                                                                          DNS Queries

                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                          Jan 13, 2024 04:58:22.074131966 CET192.168.2.51.1.1.10x3ea8Standard query (0)upgradeapi.PySimpleGUI.comA (IP address)IN (0x0001)false

                                                                          DNS Answers

                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                          Jan 13, 2024 04:58:22.222240925 CET1.1.1.1192.168.2.50x3ea8No error (0)upgradeapi.PySimpleGUI.com143.42.125.232A (IP address)IN (0x0001)false

                                                                          Statistics

                                                                          CPU Usage

                                                                          Click to jump to process

                                                                          Memory Usage

                                                                          Click to jump to process

                                                                          High Level Behavior Distribution

                                                                          Click to dive into process behavior distribution

                                                                          Behavior

                                                                          Click to jump to process

                                                                          System Behavior

                                                                          General

                                                                          Target ID:0
                                                                          Start time:04:58:11
                                                                          Start date:13/01/2024
                                                                          Path:C:\Users\user\Desktop\QuackMod.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Users\user\Desktop\QuackMod.exe
                                                                          Imagebase:0x7ff77f630000
                                                                          File size:12'093'721 bytes
                                                                          MD5 hash:8402C65C2F1AEB6E797911F653E6B7E0
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:low
                                                                          Has exited:false

                                                                          General

                                                                          Target ID:2
                                                                          Start time:04:58:19
                                                                          Start date:13/01/2024
                                                                          Path:C:\Users\user\Desktop\QuackMod.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Users\user\Desktop\QuackMod.exe
                                                                          Imagebase:0x7ff77f630000
                                                                          File size:12'093'721 bytes
                                                                          MD5 hash:8402C65C2F1AEB6E797911F653E6B7E0
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:low
                                                                          Has exited:false

                                                                          General

                                                                          Target ID:3
                                                                          Start time:04:58:21
                                                                          Start date:13/01/2024
                                                                          Path:C:\Windows\System32\cmd.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                          Imagebase:0x7ff6609c0000
                                                                          File size:289'792 bytes
                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:4
                                                                          Start time:04:58:21
                                                                          Start date:13/01/2024
                                                                          Path:C:\Windows\System32\cmd.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                          Imagebase:0x7ff6609c0000
                                                                          File size:289'792 bytes
                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:5
                                                                          Start time:04:58:21
                                                                          Start date:13/01/2024
                                                                          Path:C:\Windows\System32\conhost.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          Imagebase:0x7ff6d64d0000
                                                                          File size:862'208 bytes
                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:6
                                                                          Start time:04:58:21
                                                                          Start date:13/01/2024
                                                                          Path:C:\Windows\System32\conhost.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          Imagebase:0x7ff6d64d0000
                                                                          File size:862'208 bytes
                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          Disassembly

                                                                          Reset < >

                                                                            Execution Graph

                                                                            Execution Coverage:11.3%
                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                            Signature Coverage:18.1%
                                                                            Total number of Nodes:2000
                                                                            Total number of Limit Nodes:20
                                                                            execution_graph 19059 7ff77f65ab89 19060 7ff77f65ab98 19059->19060 19062 7ff77f65aba2 19059->19062 19063 7ff77f650d18 LeaveCriticalSection 19060->19063 19680 7ff77f645310 19681 7ff77f64531b 19680->19681 19689 7ff77f64f764 19681->19689 19702 7ff77f650cb8 EnterCriticalSection 19689->19702 19064 7ff77f64b590 19065 7ff77f64b595 19064->19065 19066 7ff77f64b5aa 19064->19066 19070 7ff77f64b5b0 19065->19070 19071 7ff77f64b5fa 19070->19071 19072 7ff77f64b5f2 19070->19072 19074 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19071->19074 19073 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19072->19073 19073->19071 19075 7ff77f64b607 19074->19075 19076 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19075->19076 19077 7ff77f64b614 19076->19077 19078 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19077->19078 19079 7ff77f64b621 19078->19079 19080 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19079->19080 19081 7ff77f64b62e 19080->19081 19082 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19081->19082 19083 7ff77f64b63b 19082->19083 19084 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19083->19084 19085 7ff77f64b648 19084->19085 19086 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19085->19086 19087 7ff77f64b655 19086->19087 19088 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19087->19088 19089 7ff77f64b665 19088->19089 19090 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19089->19090 19091 7ff77f64b675 19090->19091 19096 7ff77f64b458 19091->19096 19110 7ff77f650cb8 EnterCriticalSection 19096->19110 16142 7ff77f63c07c 16165 7ff77f63c24c 16142->16165 16145 7ff77f63c1c8 16267 7ff77f63c57c IsProcessorFeaturePresent 16145->16267 16147 7ff77f63c098 __scrt_acquire_startup_lock 16148 7ff77f63c1d2 16147->16148 16149 7ff77f63c0b6 16147->16149 16150 7ff77f63c57c 7 API calls 16148->16150 16155 7ff77f63c0d7 __scrt_release_startup_lock 16149->16155 16173 7ff77f649dac 16149->16173 16153 7ff77f63c1dd __FrameHandler3::FrameUnwindToEmptyState 16150->16153 16152 7ff77f63c0db 16154 7ff77f63c161 16177 7ff77f63c6c8 16154->16177 16155->16152 16155->16154 16256 7ff77f64a0bc 16155->16256 16157 7ff77f63c166 16180 7ff77f631000 16157->16180 16162 7ff77f63c189 16162->16153 16263 7ff77f63c3e0 16162->16263 16274 7ff77f63c84c 16165->16274 16168 7ff77f63c090 16168->16145 16168->16147 16169 7ff77f63c27b 16276 7ff77f64a91c 16169->16276 16175 7ff77f649dbf 16173->16175 16174 7ff77f649de6 16174->16155 16175->16174 16319 7ff77f63bf90 16175->16319 16397 7ff77f63d0e0 16177->16397 16179 7ff77f63c6df GetStartupInfoW 16179->16157 16181 7ff77f63100b 16180->16181 16399 7ff77f6386b0 16181->16399 16183 7ff77f63101d 16406 7ff77f645ef8 16183->16406 16185 7ff77f6339cb 16413 7ff77f631eb0 16185->16413 16189 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16190 7ff77f633ae6 16189->16190 16261 7ff77f63c70c GetModuleHandleW 16190->16261 16191 7ff77f6339ea 16253 7ff77f633ad2 16191->16253 16429 7ff77f637b60 16191->16429 16193 7ff77f633a1f 16194 7ff77f633a6b 16193->16194 16196 7ff77f637b60 61 API calls 16193->16196 16444 7ff77f638040 16194->16444 16201 7ff77f633a40 __std_exception_copy 16196->16201 16197 7ff77f633a80 16448 7ff77f631cb0 16197->16448 16200 7ff77f633b71 16203 7ff77f633b95 16200->16203 16467 7ff77f6314f0 16200->16467 16201->16194 16204 7ff77f638040 58 API calls 16201->16204 16202 7ff77f631cb0 121 API calls 16205 7ff77f633ab6 16202->16205 16207 7ff77f633bef 16203->16207 16203->16253 16474 7ff77f638ae0 16203->16474 16204->16194 16209 7ff77f633aba 16205->16209 16210 7ff77f633af8 16205->16210 16488 7ff77f636de0 16207->16488 16529 7ff77f632b30 16209->16529 16210->16200 16542 7ff77f633fd0 16210->16542 16211 7ff77f633bcc 16215 7ff77f633bd1 16211->16215 16216 7ff77f633be2 SetDllDirectoryW 16211->16216 16219 7ff77f632b30 59 API calls 16215->16219 16216->16207 16219->16253 16221 7ff77f633b16 16226 7ff77f632b30 59 API calls 16221->16226 16222 7ff77f633c09 16248 7ff77f633c3b 16222->16248 16574 7ff77f6365f0 16222->16574 16224 7ff77f633d06 16492 7ff77f6334c0 16224->16492 16225 7ff77f633b44 16225->16200 16229 7ff77f633b49 16225->16229 16226->16253 16561 7ff77f64018c 16229->16561 16233 7ff77f633c5a 16239 7ff77f633ca5 16233->16239 16616 7ff77f631ef0 16233->16616 16234 7ff77f633c3d 16610 7ff77f636840 16234->16610 16239->16253 16620 7ff77f633460 16239->16620 16241 7ff77f633d2e 16243 7ff77f637b60 61 API calls 16241->16243 16246 7ff77f633d3a 16243->16246 16506 7ff77f638080 16246->16506 16247 7ff77f633ce1 16249 7ff77f636840 FreeLibrary 16247->16249 16248->16224 16248->16233 16249->16253 16253->16189 16257 7ff77f64a0d3 16256->16257 16258 7ff77f64a0f4 16256->16258 16257->16154 19009 7ff77f64a968 16258->19009 16262 7ff77f63c71d 16261->16262 16262->16162 16265 7ff77f63c3f1 16263->16265 16264 7ff77f63c1a0 16264->16152 16265->16264 16266 7ff77f63d998 __scrt_initialize_crt 7 API calls 16265->16266 16266->16264 16268 7ff77f63c5a2 _wfindfirst32i64 memcpy_s 16267->16268 16269 7ff77f63c5c1 RtlCaptureContext RtlLookupFunctionEntry 16268->16269 16270 7ff77f63c5ea RtlVirtualUnwind 16269->16270 16271 7ff77f63c626 memcpy_s 16269->16271 16270->16271 16272 7ff77f63c658 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16271->16272 16273 7ff77f63c6aa _wfindfirst32i64 16272->16273 16273->16148 16275 7ff77f63c26e __scrt_dllmain_crt_thread_attach 16274->16275 16275->16168 16275->16169 16278 7ff77f653b1c 16276->16278 16277 7ff77f63c280 16277->16168 16280 7ff77f63d998 16277->16280 16278->16277 16286 7ff77f64cae0 16278->16286 16281 7ff77f63d9aa 16280->16281 16282 7ff77f63d9a0 16280->16282 16281->16168 16298 7ff77f63dd14 16282->16298 16297 7ff77f650cb8 EnterCriticalSection 16286->16297 16299 7ff77f63dd23 16298->16299 16301 7ff77f63d9a5 16298->16301 16306 7ff77f63df50 16299->16306 16302 7ff77f63dd80 16301->16302 16303 7ff77f63ddab 16302->16303 16304 7ff77f63dd8e DeleteCriticalSection 16303->16304 16305 7ff77f63ddaf 16303->16305 16304->16303 16305->16281 16310 7ff77f63ddb8 16306->16310 16311 7ff77f63ddfc __vcrt_InitializeCriticalSectionEx 16310->16311 16317 7ff77f63ded2 TlsFree 16310->16317 16312 7ff77f63de2a LoadLibraryExW 16311->16312 16313 7ff77f63dec1 GetProcAddress 16311->16313 16311->16317 16318 7ff77f63de6d LoadLibraryExW 16311->16318 16314 7ff77f63de4b GetLastError 16312->16314 16315 7ff77f63dea1 16312->16315 16313->16317 16314->16311 16315->16313 16316 7ff77f63deb8 FreeLibrary 16315->16316 16316->16313 16318->16311 16318->16315 16320 7ff77f63bfa0 16319->16320 16336 7ff77f64a138 16320->16336 16322 7ff77f63bfac 16342 7ff77f63c298 16322->16342 16324 7ff77f63c019 16326 7ff77f63c57c 7 API calls 16324->16326 16335 7ff77f63c035 16324->16335 16325 7ff77f63bfc4 _RTC_Initialize 16325->16324 16347 7ff77f63c448 16325->16347 16327 7ff77f63c045 16326->16327 16327->16175 16329 7ff77f63bfd9 16350 7ff77f6495a4 16329->16350 16335->16175 16337 7ff77f64a149 16336->16337 16338 7ff77f64a151 16337->16338 16339 7ff77f6454c4 memcpy_s 11 API calls 16337->16339 16338->16322 16340 7ff77f64a160 16339->16340 16341 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 16340->16341 16341->16338 16343 7ff77f63c2a9 16342->16343 16346 7ff77f63c2ae __scrt_release_startup_lock 16342->16346 16344 7ff77f63c57c 7 API calls 16343->16344 16343->16346 16345 7ff77f63c322 16344->16345 16346->16325 16376 7ff77f63c40c 16347->16376 16349 7ff77f63c451 16349->16329 16351 7ff77f63bfe5 16350->16351 16352 7ff77f6495c4 16350->16352 16351->16324 16375 7ff77f63c51c InitializeSListHead 16351->16375 16353 7ff77f6495cc 16352->16353 16354 7ff77f6495e2 GetModuleFileNameW 16352->16354 16355 7ff77f6454c4 memcpy_s 11 API calls 16353->16355 16358 7ff77f64960d 16354->16358 16356 7ff77f6495d1 16355->16356 16357 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 16356->16357 16357->16351 16391 7ff77f649544 16358->16391 16361 7ff77f649655 16362 7ff77f6454c4 memcpy_s 11 API calls 16361->16362 16363 7ff77f64965a 16362->16363 16364 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16363->16364 16367 7ff77f649668 16364->16367 16365 7ff77f64966d 16366 7ff77f64968f 16365->16366 16369 7ff77f6496bb 16365->16369 16370 7ff77f6496d4 16365->16370 16368 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16366->16368 16367->16351 16368->16351 16371 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16369->16371 16373 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16370->16373 16372 7ff77f6496c4 16371->16372 16374 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16372->16374 16373->16366 16374->16367 16377 7ff77f63c426 16376->16377 16379 7ff77f63c41f 16376->16379 16380 7ff77f64a77c 16377->16380 16379->16349 16383 7ff77f64a3b8 16380->16383 16390 7ff77f650cb8 EnterCriticalSection 16383->16390 16392 7ff77f649594 16391->16392 16393 7ff77f64955c 16391->16393 16392->16361 16392->16365 16393->16392 16394 7ff77f64f158 memcpy_s 11 API calls 16393->16394 16395 7ff77f64958a 16394->16395 16396 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16395->16396 16396->16392 16398 7ff77f63d0c0 16397->16398 16398->16179 16398->16398 16401 7ff77f6386cf 16399->16401 16400 7ff77f638720 WideCharToMultiByte 16400->16401 16403 7ff77f6387c6 16400->16403 16401->16400 16401->16403 16404 7ff77f638774 WideCharToMultiByte 16401->16404 16405 7ff77f6386d7 __std_exception_copy 16401->16405 16668 7ff77f6329e0 16403->16668 16404->16401 16404->16403 16405->16183 16409 7ff77f650050 16406->16409 16407 7ff77f6500a3 16408 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16407->16408 16410 7ff77f6500cc 16408->16410 16409->16407 16411 7ff77f6500f6 16409->16411 16410->16185 16999 7ff77f64ff28 16411->16999 16414 7ff77f631ec5 16413->16414 16415 7ff77f631ee0 16414->16415 17007 7ff77f632890 16414->17007 16415->16253 16417 7ff77f633ec0 16415->16417 16418 7ff77f63bc60 16417->16418 16419 7ff77f633ecc GetModuleFileNameW 16418->16419 16420 7ff77f633efb 16419->16420 16421 7ff77f633f12 16419->16421 16422 7ff77f6329e0 57 API calls 16420->16422 17047 7ff77f638bf0 16421->17047 16424 7ff77f633f0e 16422->16424 16427 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16424->16427 16426 7ff77f632b30 59 API calls 16426->16424 16428 7ff77f633f4f 16427->16428 16428->16191 16430 7ff77f637b6a 16429->16430 16431 7ff77f638ae0 57 API calls 16430->16431 16432 7ff77f637b8c GetEnvironmentVariableW 16431->16432 16433 7ff77f637bf6 16432->16433 16434 7ff77f637ba4 ExpandEnvironmentStringsW 16432->16434 16435 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16433->16435 16436 7ff77f638bf0 59 API calls 16434->16436 16437 7ff77f637c08 16435->16437 16438 7ff77f637bcc 16436->16438 16437->16193 16438->16433 16439 7ff77f637bd6 16438->16439 17058 7ff77f64a99c 16439->17058 16442 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16443 7ff77f637bee 16442->16443 16443->16193 16445 7ff77f638ae0 57 API calls 16444->16445 16446 7ff77f638057 SetEnvironmentVariableW 16445->16446 16447 7ff77f63806f __std_exception_copy 16446->16447 16447->16197 16449 7ff77f631cbe 16448->16449 16450 7ff77f631ef0 49 API calls 16449->16450 16451 7ff77f631cf4 16450->16451 16452 7ff77f631dde 16451->16452 16453 7ff77f631ef0 49 API calls 16451->16453 16455 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16452->16455 16454 7ff77f631d1a 16453->16454 16454->16452 17065 7ff77f631aa0 16454->17065 16456 7ff77f631e6c 16455->16456 16456->16200 16456->16202 16460 7ff77f631dcc 16461 7ff77f633e40 49 API calls 16460->16461 16461->16452 16462 7ff77f631d8f 16462->16460 16463 7ff77f631e34 16462->16463 16464 7ff77f633e40 49 API calls 16463->16464 16465 7ff77f631e41 16464->16465 17101 7ff77f634050 16465->17101 16468 7ff77f631506 16467->16468 16471 7ff77f63157f 16467->16471 17143 7ff77f637950 16468->17143 16471->16203 16472 7ff77f632b30 59 API calls 16473 7ff77f631564 16472->16473 16473->16203 16475 7ff77f638b87 MultiByteToWideChar 16474->16475 16476 7ff77f638b01 MultiByteToWideChar 16474->16476 16477 7ff77f638baa 16475->16477 16478 7ff77f638bcf 16475->16478 16479 7ff77f638b27 16476->16479 16480 7ff77f638b4c 16476->16480 16481 7ff77f6329e0 55 API calls 16477->16481 16478->16211 16482 7ff77f6329e0 55 API calls 16479->16482 16480->16475 16485 7ff77f638b62 16480->16485 16483 7ff77f638bbd 16481->16483 16484 7ff77f638b3a 16482->16484 16483->16211 16484->16211 16486 7ff77f6329e0 55 API calls 16485->16486 16487 7ff77f638b75 16486->16487 16487->16211 16489 7ff77f636df5 16488->16489 16490 7ff77f633bf4 16489->16490 16491 7ff77f632890 59 API calls 16489->16491 16490->16248 16565 7ff77f636a90 16490->16565 16491->16490 16493 7ff77f633574 16492->16493 16497 7ff77f633533 16492->16497 16494 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16493->16494 16495 7ff77f6335c5 16494->16495 16495->16253 16499 7ff77f637fd0 16495->16499 16497->16493 17668 7ff77f631710 16497->17668 17710 7ff77f632d70 16497->17710 16500 7ff77f638ae0 57 API calls 16499->16500 16501 7ff77f637fef 16500->16501 16502 7ff77f638ae0 57 API calls 16501->16502 16503 7ff77f637fff 16502->16503 16504 7ff77f647dec 38 API calls 16503->16504 16505 7ff77f63800d __std_exception_copy 16504->16505 16505->16241 16507 7ff77f638090 16506->16507 16508 7ff77f638ae0 57 API calls 16507->16508 16509 7ff77f6380c1 SetConsoleCtrlHandler GetStartupInfoW 16508->16509 16530 7ff77f632b50 16529->16530 16531 7ff77f644ac4 49 API calls 16530->16531 16532 7ff77f632b9b memcpy_s 16531->16532 16533 7ff77f638ae0 57 API calls 16532->16533 16534 7ff77f632bd0 16533->16534 16535 7ff77f632c0d MessageBoxA 16534->16535 16536 7ff77f632bd5 16534->16536 16537 7ff77f632c27 16535->16537 16538 7ff77f638ae0 57 API calls 16536->16538 16539 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16537->16539 16540 7ff77f632bef MessageBoxW 16538->16540 16541 7ff77f632c37 16539->16541 16540->16537 16541->16253 16543 7ff77f633fdc 16542->16543 16544 7ff77f638ae0 57 API calls 16543->16544 16545 7ff77f634007 16544->16545 16546 7ff77f638ae0 57 API calls 16545->16546 16547 7ff77f63401a 16546->16547 18167 7ff77f6464a8 16547->18167 16550 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16551 7ff77f633b0e 16550->16551 16551->16221 16552 7ff77f6382b0 16551->16552 16553 7ff77f6382d4 16552->16553 16554 7ff77f640814 73 API calls 16553->16554 16559 7ff77f6383ab __std_exception_copy 16553->16559 16555 7ff77f6382ee 16554->16555 16555->16559 18546 7ff77f649070 16555->18546 16559->16225 16562 7ff77f6401bc 16561->16562 18561 7ff77f63ff68 16562->18561 16566 7ff77f636aca 16565->16566 16567 7ff77f636ab3 16565->16567 16566->16222 16567->16566 18572 7ff77f6315a0 16567->18572 16569 7ff77f636ad4 16569->16566 16570 7ff77f634050 49 API calls 16569->16570 16571 7ff77f636b35 16570->16571 16572 7ff77f632b30 59 API calls 16571->16572 16573 7ff77f636ba5 __std_exception_copy memcpy_s 16571->16573 16572->16566 16573->16222 16575 7ff77f63660a memcpy_s 16574->16575 16576 7ff77f63672f 16575->16576 16578 7ff77f63674b 16575->16578 16582 7ff77f634050 49 API calls 16575->16582 16583 7ff77f636710 16575->16583 16591 7ff77f631710 144 API calls 16575->16591 16592 7ff77f636731 16575->16592 18596 7ff77f631950 16575->18596 16579 7ff77f634050 49 API calls 16576->16579 16581 7ff77f632b30 59 API calls 16578->16581 16580 7ff77f6367a8 16579->16580 16584 7ff77f634050 49 API calls 16580->16584 16587 7ff77f636741 __std_exception_copy 16581->16587 16582->16575 16583->16576 16585 7ff77f634050 49 API calls 16583->16585 16586 7ff77f6367d8 16584->16586 16585->16576 16590 7ff77f634050 49 API calls 16586->16590 16588 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16587->16588 16589 7ff77f633c1a 16588->16589 16589->16234 16594 7ff77f636570 16589->16594 16590->16587 16591->16575 16593 7ff77f632b30 59 API calls 16592->16593 16593->16587 18600 7ff77f638260 16594->18600 16596 7ff77f63658c 16597 7ff77f638260 58 API calls 16596->16597 16598 7ff77f63659f 16597->16598 16599 7ff77f6365d5 16598->16599 16601 7ff77f6365b7 16598->16601 16600 7ff77f632b30 59 API calls 16599->16600 18604 7ff77f636ef0 GetProcAddress 16601->18604 16611 7ff77f636852 16610->16611 16615 7ff77f63687d 16610->16615 16613 7ff77f63693b 16611->16613 16611->16615 18663 7ff77f638240 FreeLibrary 16611->18663 16613->16615 18664 7ff77f638240 FreeLibrary 16613->18664 16615->16248 16617 7ff77f631f15 16616->16617 16618 7ff77f644ac4 49 API calls 16617->16618 16619 7ff77f631f38 16618->16619 16619->16239 18665 7ff77f635bc0 16620->18665 16623 7ff77f6334ad 16623->16247 16687 7ff77f63bc60 16668->16687 16671 7ff77f632a29 16689 7ff77f644ac4 16671->16689 16676 7ff77f631ef0 49 API calls 16677 7ff77f632a86 memcpy_s 16676->16677 16678 7ff77f638ae0 54 API calls 16677->16678 16679 7ff77f632abb 16678->16679 16680 7ff77f632af8 MessageBoxA 16679->16680 16681 7ff77f632ac0 16679->16681 16683 7ff77f632b12 16680->16683 16682 7ff77f638ae0 54 API calls 16681->16682 16684 7ff77f632ada MessageBoxW 16682->16684 16685 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16683->16685 16684->16683 16686 7ff77f632b22 16685->16686 16686->16405 16688 7ff77f6329fc GetLastError 16687->16688 16688->16671 16690 7ff77f644b1e 16689->16690 16691 7ff77f644b43 16690->16691 16692 7ff77f644b7f 16690->16692 16693 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16691->16693 16719 7ff77f642d50 16692->16719 16695 7ff77f644b6d 16693->16695 16698 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16695->16698 16696 7ff77f644c5c 16697 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16696->16697 16697->16695 16700 7ff77f632a57 16698->16700 16707 7ff77f638560 16700->16707 16701 7ff77f644c31 16705 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16701->16705 16702 7ff77f644c80 16702->16696 16704 7ff77f644c8a 16702->16704 16703 7ff77f644c28 16703->16696 16703->16701 16706 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16704->16706 16705->16695 16706->16695 16708 7ff77f63856c 16707->16708 16709 7ff77f638587 GetLastError 16708->16709 16710 7ff77f63858d FormatMessageW 16708->16710 16709->16710 16711 7ff77f6385dc WideCharToMultiByte 16710->16711 16712 7ff77f6385c0 16710->16712 16714 7ff77f6385d3 16711->16714 16715 7ff77f638616 16711->16715 16713 7ff77f6329e0 54 API calls 16712->16713 16713->16714 16717 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16714->16717 16716 7ff77f6329e0 54 API calls 16715->16716 16716->16714 16718 7ff77f632a5e 16717->16718 16718->16676 16720 7ff77f642d8e 16719->16720 16721 7ff77f642d7e 16719->16721 16722 7ff77f642d97 16720->16722 16723 7ff77f642dc5 16720->16723 16724 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16721->16724 16725 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16722->16725 16723->16721 16726 7ff77f642dbd 16723->16726 16729 7ff77f643074 16723->16729 16733 7ff77f6436e0 16723->16733 16759 7ff77f6433a8 16723->16759 16789 7ff77f642c30 16723->16789 16792 7ff77f644900 16723->16792 16724->16726 16725->16726 16726->16696 16726->16701 16726->16702 16726->16703 16731 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16729->16731 16731->16721 16734 7ff77f643722 16733->16734 16735 7ff77f643795 16733->16735 16738 7ff77f643728 16734->16738 16739 7ff77f6437bf 16734->16739 16736 7ff77f64379a 16735->16736 16737 7ff77f6437ef 16735->16737 16740 7ff77f64379c 16736->16740 16741 7ff77f6437cf 16736->16741 16737->16739 16749 7ff77f6437fe 16737->16749 16757 7ff77f643758 16737->16757 16746 7ff77f64372d 16738->16746 16738->16749 16816 7ff77f641c90 16739->16816 16742 7ff77f64373d 16740->16742 16748 7ff77f6437ab 16740->16748 16823 7ff77f641880 16741->16823 16758 7ff77f64382d 16742->16758 16798 7ff77f644044 16742->16798 16746->16742 16747 7ff77f643770 16746->16747 16746->16757 16747->16758 16808 7ff77f644500 16747->16808 16748->16739 16751 7ff77f6437b0 16748->16751 16749->16758 16830 7ff77f6420a0 16749->16830 16751->16758 16812 7ff77f644698 16751->16812 16753 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16755 7ff77f643ac3 16753->16755 16755->16723 16757->16758 16837 7ff77f64ee18 16757->16837 16758->16753 16760 7ff77f6433c9 16759->16760 16761 7ff77f6433b3 16759->16761 16762 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16760->16762 16763 7ff77f643407 16760->16763 16761->16763 16764 7ff77f643722 16761->16764 16765 7ff77f643795 16761->16765 16762->16763 16763->16723 16768 7ff77f643728 16764->16768 16769 7ff77f6437bf 16764->16769 16766 7ff77f64379a 16765->16766 16767 7ff77f6437ef 16765->16767 16770 7ff77f64379c 16766->16770 16771 7ff77f6437cf 16766->16771 16767->16769 16778 7ff77f6437fe 16767->16778 16787 7ff77f643758 16767->16787 16776 7ff77f64372d 16768->16776 16768->16778 16773 7ff77f641c90 38 API calls 16769->16773 16772 7ff77f64373d 16770->16772 16780 7ff77f6437ab 16770->16780 16774 7ff77f641880 38 API calls 16771->16774 16775 7ff77f644044 47 API calls 16772->16775 16788 7ff77f64382d 16772->16788 16773->16787 16774->16787 16775->16787 16776->16772 16777 7ff77f643770 16776->16777 16776->16787 16781 7ff77f644500 47 API calls 16777->16781 16777->16788 16779 7ff77f6420a0 38 API calls 16778->16779 16778->16788 16779->16787 16780->16769 16782 7ff77f6437b0 16780->16782 16781->16787 16784 7ff77f644698 37 API calls 16782->16784 16782->16788 16783 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16785 7ff77f643ac3 16783->16785 16784->16787 16785->16723 16786 7ff77f64ee18 47 API calls 16786->16787 16787->16786 16787->16788 16788->16783 16974 7ff77f640e54 16789->16974 16793 7ff77f644917 16792->16793 16991 7ff77f64df78 16793->16991 16799 7ff77f644066 16798->16799 16847 7ff77f640cc0 16799->16847 16804 7ff77f644900 45 API calls 16806 7ff77f6441a3 16804->16806 16805 7ff77f644900 45 API calls 16807 7ff77f64422c 16805->16807 16806->16805 16806->16806 16806->16807 16807->16757 16809 7ff77f644518 16808->16809 16811 7ff77f644580 16808->16811 16810 7ff77f64ee18 47 API calls 16809->16810 16809->16811 16810->16811 16811->16757 16815 7ff77f6446b9 16812->16815 16813 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16814 7ff77f6446ea 16813->16814 16814->16757 16815->16813 16815->16814 16817 7ff77f641cc3 16816->16817 16818 7ff77f641cf2 16817->16818 16820 7ff77f641daf 16817->16820 16819 7ff77f640cc0 12 API calls 16818->16819 16821 7ff77f641d2f 16818->16821 16819->16821 16822 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16820->16822 16821->16757 16822->16821 16824 7ff77f6418b3 16823->16824 16825 7ff77f6418e2 16824->16825 16827 7ff77f64199f 16824->16827 16826 7ff77f640cc0 12 API calls 16825->16826 16829 7ff77f64191f 16825->16829 16826->16829 16828 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16827->16828 16828->16829 16829->16757 16831 7ff77f6420d3 16830->16831 16832 7ff77f642102 16831->16832 16834 7ff77f6421bf 16831->16834 16833 7ff77f640cc0 12 API calls 16832->16833 16836 7ff77f64213f 16832->16836 16833->16836 16835 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16834->16835 16835->16836 16836->16757 16838 7ff77f64ee40 16837->16838 16839 7ff77f644900 45 API calls 16838->16839 16840 7ff77f64ee85 16838->16840 16844 7ff77f64ee45 memcpy_s 16838->16844 16846 7ff77f64ee6e memcpy_s 16838->16846 16839->16840 16842 7ff77f6504c8 WideCharToMultiByte 16840->16842 16840->16844 16840->16846 16841 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16841->16844 16843 7ff77f64ef61 16842->16843 16843->16844 16845 7ff77f64ef76 GetLastError 16843->16845 16844->16757 16845->16844 16845->16846 16846->16841 16846->16844 16848 7ff77f640cf7 16847->16848 16849 7ff77f640ce6 16847->16849 16848->16849 16850 7ff77f64dbbc _fread_nolock 12 API calls 16848->16850 16855 7ff77f64eb30 16849->16855 16851 7ff77f640d24 16850->16851 16852 7ff77f640d38 16851->16852 16853 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16851->16853 16854 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16852->16854 16853->16852 16854->16849 16856 7ff77f64eb4d 16855->16856 16857 7ff77f64eb80 16855->16857 16858 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16856->16858 16857->16856 16859 7ff77f64ebb2 16857->16859 16869 7ff77f644181 16858->16869 16860 7ff77f64ebfa 16859->16860 16866 7ff77f64ecc5 16859->16866 16860->16869 16873 7ff77f64aa3c __std_exception_copy 37 API calls 16860->16873 16861 7ff77f64edb7 16901 7ff77f64e01c 16861->16901 16863 7ff77f64ed7d 16894 7ff77f64e3b4 16863->16894 16865 7ff77f64ed4c 16887 7ff77f64e694 16865->16887 16866->16861 16866->16863 16866->16865 16868 7ff77f64ed0f 16866->16868 16871 7ff77f64ed05 16866->16871 16877 7ff77f64e8c4 16868->16877 16869->16804 16869->16806 16871->16863 16872 7ff77f64ed0a 16871->16872 16872->16865 16872->16868 16874 7ff77f64ecb2 16873->16874 16874->16869 16875 7ff77f64aec4 _wfindfirst32i64 17 API calls 16874->16875 16876 7ff77f64ee14 16875->16876 16910 7ff77f65471c 16877->16910 16881 7ff77f64e96c 16882 7ff77f64e970 16881->16882 16883 7ff77f64e9c1 16881->16883 16885 7ff77f64e98c 16881->16885 16882->16869 16963 7ff77f64e4b0 16883->16963 16959 7ff77f64e76c 16885->16959 16888 7ff77f65471c 38 API calls 16887->16888 16889 7ff77f64e6de 16888->16889 16890 7ff77f654164 37 API calls 16889->16890 16891 7ff77f64e72e 16890->16891 16892 7ff77f64e732 16891->16892 16893 7ff77f64e76c 45 API calls 16891->16893 16892->16869 16893->16892 16895 7ff77f65471c 38 API calls 16894->16895 16896 7ff77f64e3ff 16895->16896 16897 7ff77f654164 37 API calls 16896->16897 16898 7ff77f64e457 16897->16898 16899 7ff77f64e45b 16898->16899 16900 7ff77f64e4b0 45 API calls 16898->16900 16899->16869 16900->16899 16902 7ff77f64e094 16901->16902 16903 7ff77f64e061 16901->16903 16905 7ff77f64e0ac 16902->16905 16907 7ff77f64e12d 16902->16907 16904 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16903->16904 16909 7ff77f64e08d memcpy_s 16904->16909 16906 7ff77f64e3b4 46 API calls 16905->16906 16906->16909 16908 7ff77f644900 45 API calls 16907->16908 16907->16909 16908->16909 16909->16869 16911 7ff77f65476f fegetenv 16910->16911 16912 7ff77f65867c 37 API calls 16911->16912 16915 7ff77f6547c2 16912->16915 16913 7ff77f6547ef 16918 7ff77f64aa3c __std_exception_copy 37 API calls 16913->16918 16914 7ff77f6548b2 16916 7ff77f65867c 37 API calls 16914->16916 16915->16914 16919 7ff77f65488c 16915->16919 16920 7ff77f6547dd 16915->16920 16917 7ff77f6548dc 16916->16917 16921 7ff77f65867c 37 API calls 16917->16921 16922 7ff77f65486d 16918->16922 16925 7ff77f64aa3c __std_exception_copy 37 API calls 16919->16925 16920->16913 16920->16914 16923 7ff77f6548ed 16921->16923 16924 7ff77f655994 16922->16924 16929 7ff77f654875 16922->16929 16926 7ff77f658870 20 API calls 16923->16926 16927 7ff77f64aec4 _wfindfirst32i64 17 API calls 16924->16927 16925->16922 16937 7ff77f654956 memcpy_s 16926->16937 16928 7ff77f6559a9 16927->16928 16930 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16929->16930 16931 7ff77f64e911 16930->16931 16955 7ff77f654164 16931->16955 16932 7ff77f654cff memcpy_s 16933 7ff77f65503f 16934 7ff77f654280 37 API calls 16933->16934 16941 7ff77f655757 16934->16941 16935 7ff77f654feb 16935->16933 16938 7ff77f6559ac memcpy_s 37 API calls 16935->16938 16936 7ff77f654997 memcpy_s 16950 7ff77f654df3 memcpy_s 16936->16950 16951 7ff77f6552db memcpy_s 16936->16951 16937->16932 16937->16936 16939 7ff77f6454c4 memcpy_s 11 API calls 16937->16939 16938->16933 16940 7ff77f654dd0 16939->16940 16942 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 16940->16942 16943 7ff77f6559ac memcpy_s 37 API calls 16941->16943 16953 7ff77f6557b2 16941->16953 16942->16936 16943->16953 16944 7ff77f655938 16946 7ff77f65867c 37 API calls 16944->16946 16945 7ff77f6454c4 11 API calls memcpy_s 16945->16950 16946->16929 16947 7ff77f6454c4 11 API calls memcpy_s 16947->16951 16948 7ff77f654280 37 API calls 16948->16953 16949 7ff77f64aea4 37 API calls _invalid_parameter_noinfo 16949->16950 16950->16935 16950->16945 16950->16949 16951->16933 16951->16935 16951->16947 16954 7ff77f64aea4 37 API calls _invalid_parameter_noinfo 16951->16954 16952 7ff77f6559ac memcpy_s 37 API calls 16952->16953 16953->16944 16953->16948 16953->16952 16954->16951 16956 7ff77f654183 16955->16956 16957 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16956->16957 16958 7ff77f6541ae memcpy_s 16956->16958 16957->16958 16958->16881 16960 7ff77f64e798 memcpy_s 16959->16960 16961 7ff77f644900 45 API calls 16960->16961 16962 7ff77f64e852 memcpy_s 16960->16962 16961->16962 16962->16882 16964 7ff77f64e4eb 16963->16964 16967 7ff77f64e538 memcpy_s 16963->16967 16965 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16964->16965 16966 7ff77f64e517 16965->16966 16966->16882 16968 7ff77f64e5a3 16967->16968 16970 7ff77f644900 45 API calls 16967->16970 16969 7ff77f64aa3c __std_exception_copy 37 API calls 16968->16969 16971 7ff77f64e5e5 memcpy_s 16969->16971 16970->16968 16972 7ff77f64aec4 _wfindfirst32i64 17 API calls 16971->16972 16973 7ff77f64e690 16972->16973 16975 7ff77f640e81 16974->16975 16976 7ff77f640e93 16974->16976 16977 7ff77f6454c4 memcpy_s 11 API calls 16975->16977 16978 7ff77f640ea0 16976->16978 16982 7ff77f640edd 16976->16982 16979 7ff77f640e86 16977->16979 16980 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 16978->16980 16981 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 16979->16981 16986 7ff77f640e91 16980->16986 16981->16986 16983 7ff77f640f86 16982->16983 16984 7ff77f6454c4 memcpy_s 11 API calls 16982->16984 16985 7ff77f6454c4 memcpy_s 11 API calls 16983->16985 16983->16986 16987 7ff77f640f7b 16984->16987 16988 7ff77f641030 16985->16988 16986->16723 16989 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 16987->16989 16990 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 16988->16990 16989->16983 16990->16986 16992 7ff77f64493f 16991->16992 16993 7ff77f64df91 16991->16993 16995 7ff77f64dfe4 16992->16995 16993->16992 16994 7ff77f653974 45 API calls 16993->16994 16994->16992 16996 7ff77f64dffd 16995->16996 16998 7ff77f64494f 16995->16998 16997 7ff77f652cc0 45 API calls 16996->16997 16996->16998 16997->16998 16998->16723 17006 7ff77f64536c EnterCriticalSection 16999->17006 17008 7ff77f6328ac 17007->17008 17009 7ff77f644ac4 49 API calls 17008->17009 17010 7ff77f6328fd 17009->17010 17011 7ff77f6454c4 memcpy_s 11 API calls 17010->17011 17012 7ff77f632902 17011->17012 17026 7ff77f6454e4 17012->17026 17015 7ff77f631ef0 49 API calls 17016 7ff77f632931 memcpy_s 17015->17016 17017 7ff77f638ae0 57 API calls 17016->17017 17018 7ff77f632966 17017->17018 17019 7ff77f63296b 17018->17019 17020 7ff77f6329a3 MessageBoxA 17018->17020 17021 7ff77f638ae0 57 API calls 17019->17021 17022 7ff77f6329bd 17020->17022 17023 7ff77f632985 MessageBoxW 17021->17023 17024 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17022->17024 17023->17022 17025 7ff77f6329cd 17024->17025 17025->16415 17027 7ff77f64b888 memcpy_s 11 API calls 17026->17027 17028 7ff77f6454fb 17027->17028 17029 7ff77f632909 17028->17029 17030 7ff77f64f158 memcpy_s 11 API calls 17028->17030 17033 7ff77f64553b 17028->17033 17029->17015 17031 7ff77f645530 17030->17031 17032 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17031->17032 17032->17033 17033->17029 17038 7ff77f64f828 17033->17038 17036 7ff77f64aec4 _wfindfirst32i64 17 API calls 17037 7ff77f645580 17036->17037 17042 7ff77f64f845 17038->17042 17039 7ff77f64f84a 17040 7ff77f645561 17039->17040 17041 7ff77f6454c4 memcpy_s 11 API calls 17039->17041 17040->17029 17040->17036 17046 7ff77f64f854 17041->17046 17042->17039 17042->17040 17044 7ff77f64f894 17042->17044 17043 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 17043->17040 17044->17040 17045 7ff77f6454c4 memcpy_s 11 API calls 17044->17045 17045->17046 17046->17043 17048 7ff77f638c82 WideCharToMultiByte 17047->17048 17049 7ff77f638c14 WideCharToMultiByte 17047->17049 17052 7ff77f638caf 17048->17052 17053 7ff77f633f25 17048->17053 17050 7ff77f638c3e 17049->17050 17051 7ff77f638c55 17049->17051 17054 7ff77f6329e0 57 API calls 17050->17054 17051->17048 17056 7ff77f638c6b 17051->17056 17055 7ff77f6329e0 57 API calls 17052->17055 17053->16424 17053->16426 17054->17053 17055->17053 17057 7ff77f6329e0 57 API calls 17056->17057 17057->17053 17059 7ff77f64a9b3 17058->17059 17062 7ff77f637bde 17058->17062 17060 7ff77f64aa3c __std_exception_copy 37 API calls 17059->17060 17059->17062 17061 7ff77f64a9e0 17060->17061 17061->17062 17063 7ff77f64aec4 _wfindfirst32i64 17 API calls 17061->17063 17062->16442 17064 7ff77f64aa10 17063->17064 17066 7ff77f633fd0 116 API calls 17065->17066 17067 7ff77f631ad6 17066->17067 17068 7ff77f631c84 17067->17068 17069 7ff77f6382b0 83 API calls 17067->17069 17070 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17068->17070 17071 7ff77f631b0e 17069->17071 17072 7ff77f631c98 17070->17072 17097 7ff77f631b3f 17071->17097 17104 7ff77f640814 17071->17104 17072->16452 17098 7ff77f633e40 17072->17098 17074 7ff77f64018c 74 API calls 17074->17068 17075 7ff77f631b28 17076 7ff77f631b2c 17075->17076 17077 7ff77f631b44 17075->17077 17078 7ff77f632890 59 API calls 17076->17078 17108 7ff77f6404dc 17077->17108 17078->17097 17081 7ff77f631b77 17083 7ff77f640814 73 API calls 17081->17083 17082 7ff77f631b5f 17084 7ff77f632890 59 API calls 17082->17084 17085 7ff77f631bc4 17083->17085 17084->17097 17086 7ff77f631bee 17085->17086 17087 7ff77f631bd6 17085->17087 17089 7ff77f6404dc _fread_nolock 53 API calls 17086->17089 17088 7ff77f632890 59 API calls 17087->17088 17088->17097 17090 7ff77f631c03 17089->17090 17091 7ff77f631c09 17090->17091 17092 7ff77f631c1e 17090->17092 17094 7ff77f632890 59 API calls 17091->17094 17111 7ff77f640250 17092->17111 17094->17097 17096 7ff77f632b30 59 API calls 17096->17097 17097->17074 17099 7ff77f631ef0 49 API calls 17098->17099 17100 7ff77f633e5d 17099->17100 17100->16462 17102 7ff77f631ef0 49 API calls 17101->17102 17103 7ff77f634080 17102->17103 17103->16452 17105 7ff77f640844 17104->17105 17117 7ff77f6405a4 17105->17117 17107 7ff77f64085d 17107->17075 17129 7ff77f6404fc 17108->17129 17112 7ff77f640259 17111->17112 17113 7ff77f631c32 17111->17113 17114 7ff77f6454c4 memcpy_s 11 API calls 17112->17114 17113->17096 17113->17097 17118 7ff77f64060e 17117->17118 17119 7ff77f6405ce 17117->17119 17118->17119 17121 7ff77f64061a 17118->17121 17120 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17119->17120 17122 7ff77f6405f5 17120->17122 17128 7ff77f64536c EnterCriticalSection 17121->17128 17122->17107 17130 7ff77f640526 17129->17130 17131 7ff77f631b59 17129->17131 17130->17131 17132 7ff77f640572 17130->17132 17133 7ff77f640535 memcpy_s 17130->17133 17131->17081 17131->17082 17142 7ff77f64536c EnterCriticalSection 17132->17142 17135 7ff77f6454c4 memcpy_s 11 API calls 17133->17135 17137 7ff77f64054a 17135->17137 17139 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 17137->17139 17139->17131 17144 7ff77f637966 17143->17144 17145 7ff77f63798a 17144->17145 17146 7ff77f6379dd GetTempPathW 17144->17146 17148 7ff77f637b60 61 API calls 17145->17148 17147 7ff77f6379f2 17146->17147 17182 7ff77f632830 17147->17182 17149 7ff77f637996 17148->17149 17206 7ff77f637420 17149->17206 17155 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17157 7ff77f63154f 17155->17157 17156 7ff77f6379bc __std_exception_copy 17156->17146 17161 7ff77f6379ca 17156->17161 17157->16471 17157->16472 17159 7ff77f637a0b __std_exception_copy 17160 7ff77f637ab6 17159->17160 17165 7ff77f637a41 17159->17165 17186 7ff77f648aa4 17159->17186 17189 7ff77f638950 17159->17189 17163 7ff77f638bf0 59 API calls 17160->17163 17162 7ff77f632b30 59 API calls 17161->17162 17167 7ff77f637ac7 __std_exception_copy 17163->17167 17166 7ff77f638ae0 57 API calls 17165->17166 17181 7ff77f637a7a __std_exception_copy 17165->17181 17169 7ff77f637a57 17166->17169 17168 7ff77f638ae0 57 API calls 17167->17168 17167->17181 17170 7ff77f637ae5 17168->17170 17171 7ff77f637a99 SetEnvironmentVariableW 17169->17171 17172 7ff77f637a5c 17169->17172 17173 7ff77f637aea 17170->17173 17174 7ff77f637b1d SetEnvironmentVariableW 17170->17174 17171->17181 17175 7ff77f638ae0 57 API calls 17172->17175 17176 7ff77f638ae0 57 API calls 17173->17176 17174->17181 17177 7ff77f637a6c 17175->17177 17178 7ff77f637afa 17176->17178 17179 7ff77f647dec 38 API calls 17177->17179 17180 7ff77f647dec 38 API calls 17178->17180 17179->17181 17180->17181 17181->17155 17183 7ff77f632855 17182->17183 17240 7ff77f644d18 17183->17240 17431 7ff77f6486d0 17186->17431 17190 7ff77f63bc60 17189->17190 17191 7ff77f638960 GetCurrentProcess OpenProcessToken 17190->17191 17192 7ff77f6389ab GetTokenInformation 17191->17192 17195 7ff77f638a21 __std_exception_copy 17191->17195 17193 7ff77f6389cd GetLastError 17192->17193 17194 7ff77f6389d8 17192->17194 17193->17194 17193->17195 17194->17195 17199 7ff77f6389ee GetTokenInformation 17194->17199 17196 7ff77f638a3a 17195->17196 17197 7ff77f638a34 FindCloseChangeNotification 17195->17197 17557 7ff77f638650 17196->17557 17197->17196 17199->17195 17201 7ff77f638a14 ConvertSidToStringSidW 17199->17201 17201->17195 17207 7ff77f63742c 17206->17207 17208 7ff77f638ae0 57 API calls 17207->17208 17209 7ff77f63744e 17208->17209 17210 7ff77f637469 ExpandEnvironmentStringsW 17209->17210 17211 7ff77f637456 17209->17211 17213 7ff77f63748f __std_exception_copy 17210->17213 17212 7ff77f632b30 59 API calls 17211->17212 17219 7ff77f637462 17212->17219 17214 7ff77f6374a6 17213->17214 17215 7ff77f637493 17213->17215 17220 7ff77f6374c0 17214->17220 17221 7ff77f6374b4 17214->17221 17217 7ff77f632b30 59 API calls 17215->17217 17216 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17218 7ff77f637588 17216->17218 17217->17219 17218->17181 17230 7ff77f647dec 17218->17230 17219->17216 17568 7ff77f646328 17220->17568 17561 7ff77f6479a4 17221->17561 17224 7ff77f6374be 17225 7ff77f6374da 17224->17225 17228 7ff77f6374ed memcpy_s 17224->17228 17226 7ff77f632b30 59 API calls 17225->17226 17226->17219 17227 7ff77f637562 CreateDirectoryW 17227->17219 17228->17227 17229 7ff77f63753c CreateDirectoryW 17228->17229 17229->17228 17231 7ff77f647df9 17230->17231 17232 7ff77f647e0c 17230->17232 17233 7ff77f6454c4 memcpy_s 11 API calls 17231->17233 17660 7ff77f647a70 17232->17660 17235 7ff77f647dfe 17233->17235 17237 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 17235->17237 17238 7ff77f647e0a 17237->17238 17238->17156 17243 7ff77f644d72 17240->17243 17241 7ff77f644d97 17242 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17241->17242 17246 7ff77f644dc1 17242->17246 17243->17241 17244 7ff77f644dd3 17243->17244 17258 7ff77f6430d0 17244->17258 17248 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17246->17248 17247 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17247->17246 17250 7ff77f632874 17248->17250 17250->17159 17251 7ff77f644eda 17253 7ff77f644eb4 17251->17253 17254 7ff77f644ee4 17251->17254 17252 7ff77f644e80 17252->17253 17256 7ff77f644e89 17252->17256 17253->17247 17257 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17254->17257 17255 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17255->17246 17256->17255 17257->17246 17259 7ff77f64310e 17258->17259 17260 7ff77f6430fe 17258->17260 17261 7ff77f643117 17259->17261 17265 7ff77f643145 17259->17265 17264 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17260->17264 17262 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17261->17262 17263 7ff77f64313d 17262->17263 17263->17251 17263->17252 17263->17253 17263->17256 17264->17263 17265->17260 17265->17263 17269 7ff77f643ae4 17265->17269 17302 7ff77f643530 17265->17302 17339 7ff77f642cc0 17265->17339 17270 7ff77f643b97 17269->17270 17271 7ff77f643b26 17269->17271 17274 7ff77f643b9c 17270->17274 17275 7ff77f643bf0 17270->17275 17272 7ff77f643b2c 17271->17272 17273 7ff77f643bc1 17271->17273 17276 7ff77f643b31 17272->17276 17277 7ff77f643b60 17272->17277 17358 7ff77f641e94 17273->17358 17278 7ff77f643b9e 17274->17278 17279 7ff77f643bd1 17274->17279 17280 7ff77f643bff 17275->17280 17281 7ff77f643bfa 17275->17281 17282 7ff77f643c07 17275->17282 17276->17282 17284 7ff77f643b37 17276->17284 17277->17280 17277->17284 17288 7ff77f643bad 17278->17288 17291 7ff77f643b40 17278->17291 17365 7ff77f641a84 17279->17365 17300 7ff77f643c30 17280->17300 17376 7ff77f6422a4 17280->17376 17281->17273 17281->17280 17372 7ff77f6447ec 17282->17372 17289 7ff77f643b72 17284->17289 17284->17291 17297 7ff77f643b5b 17284->17297 17288->17273 17292 7ff77f643bb2 17288->17292 17289->17300 17352 7ff77f6445d4 17289->17352 17291->17300 17342 7ff77f644298 17291->17342 17295 7ff77f644698 37 API calls 17292->17295 17292->17300 17294 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17296 7ff77f643f2a 17294->17296 17295->17297 17296->17265 17298 7ff77f644900 45 API calls 17297->17298 17297->17300 17301 7ff77f643e1c 17297->17301 17298->17301 17300->17294 17301->17300 17383 7ff77f64efc8 17301->17383 17303 7ff77f64353e 17302->17303 17304 7ff77f643554 17302->17304 17305 7ff77f643b97 17303->17305 17306 7ff77f643b26 17303->17306 17308 7ff77f643594 17303->17308 17307 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17304->17307 17304->17308 17311 7ff77f643b9c 17305->17311 17312 7ff77f643bf0 17305->17312 17309 7ff77f643b2c 17306->17309 17310 7ff77f643bc1 17306->17310 17307->17308 17308->17265 17313 7ff77f643b31 17309->17313 17314 7ff77f643b60 17309->17314 17319 7ff77f641e94 38 API calls 17310->17319 17315 7ff77f643b9e 17311->17315 17316 7ff77f643bd1 17311->17316 17317 7ff77f643bfa 17312->17317 17318 7ff77f643c07 17312->17318 17324 7ff77f643bff 17312->17324 17313->17318 17320 7ff77f643b37 17313->17320 17314->17320 17314->17324 17321 7ff77f643b40 17315->17321 17326 7ff77f643bad 17315->17326 17322 7ff77f641a84 38 API calls 17316->17322 17317->17310 17317->17324 17325 7ff77f6447ec 45 API calls 17318->17325 17336 7ff77f643b5b 17319->17336 17320->17321 17327 7ff77f643b72 17320->17327 17320->17336 17323 7ff77f644298 47 API calls 17321->17323 17338 7ff77f643c30 17321->17338 17322->17336 17323->17336 17328 7ff77f6422a4 38 API calls 17324->17328 17324->17338 17325->17336 17326->17310 17329 7ff77f643bb2 17326->17329 17330 7ff77f6445d4 46 API calls 17327->17330 17327->17338 17328->17336 17332 7ff77f644698 37 API calls 17329->17332 17329->17338 17330->17336 17331 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17333 7ff77f643f2a 17331->17333 17332->17336 17333->17265 17334 7ff77f643e1c 17337 7ff77f64efc8 46 API calls 17334->17337 17334->17338 17335 7ff77f644900 45 API calls 17335->17334 17336->17334 17336->17335 17336->17338 17337->17334 17338->17331 17414 7ff77f641108 17339->17414 17343 7ff77f6442be 17342->17343 17344 7ff77f640cc0 12 API calls 17343->17344 17345 7ff77f64430e 17344->17345 17346 7ff77f64eb30 46 API calls 17345->17346 17348 7ff77f6443e1 17346->17348 17347 7ff77f644403 17348->17347 17353 7ff77f644609 17352->17353 17354 7ff77f644627 17353->17354 17355 7ff77f644900 45 API calls 17353->17355 17357 7ff77f64464e 17353->17357 17356 7ff77f64efc8 46 API calls 17354->17356 17355->17354 17356->17357 17357->17297 17359 7ff77f641ec7 17358->17359 17360 7ff77f641ef6 17359->17360 17362 7ff77f641fb3 17359->17362 17364 7ff77f641f33 17360->17364 17395 7ff77f640d68 17360->17395 17363 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17362->17363 17363->17364 17364->17297 17366 7ff77f641ab7 17365->17366 17367 7ff77f641ae6 17366->17367 17369 7ff77f641ba3 17366->17369 17368 7ff77f640d68 12 API calls 17367->17368 17371 7ff77f641b23 17367->17371 17368->17371 17370 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17369->17370 17370->17371 17371->17297 17373 7ff77f64482f 17372->17373 17375 7ff77f644833 __crtLCMapStringW 17373->17375 17403 7ff77f644888 17373->17403 17375->17297 17377 7ff77f6422d7 17376->17377 17378 7ff77f642306 17377->17378 17380 7ff77f6423c3 17377->17380 17379 7ff77f640d68 12 API calls 17378->17379 17382 7ff77f642343 17378->17382 17379->17382 17381 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17380->17381 17381->17382 17382->17297 17385 7ff77f64eff9 17383->17385 17393 7ff77f64f007 17383->17393 17384 7ff77f64f027 17387 7ff77f64f038 17384->17387 17388 7ff77f64f05f 17384->17388 17385->17384 17386 7ff77f644900 45 API calls 17385->17386 17385->17393 17386->17384 17388->17393 17393->17301 17396 7ff77f640d9f 17395->17396 17397 7ff77f640d8e 17395->17397 17396->17397 17398 7ff77f64dbbc _fread_nolock 12 API calls 17396->17398 17397->17364 17399 7ff77f640dd0 17398->17399 17400 7ff77f640de4 17399->17400 17401 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17399->17401 17401->17400 17404 7ff77f6448ae 17403->17404 17405 7ff77f6448a6 17403->17405 17404->17375 17406 7ff77f644900 45 API calls 17405->17406 17406->17404 17415 7ff77f64113d 17414->17415 17416 7ff77f64114f 17414->17416 17417 7ff77f6454c4 memcpy_s 11 API calls 17415->17417 17419 7ff77f64115d 17416->17419 17423 7ff77f641199 17416->17423 17418 7ff77f641142 17417->17418 17420 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 17418->17420 17421 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 17419->17421 17428 7ff77f64114d 17420->17428 17421->17428 17422 7ff77f641515 17425 7ff77f6454c4 memcpy_s 11 API calls 17422->17425 17422->17428 17423->17422 17424 7ff77f6454c4 memcpy_s 11 API calls 17423->17424 17427 7ff77f64150a 17424->17427 17426 7ff77f6417a9 17425->17426 17429 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 17426->17429 17430 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 17427->17430 17428->17265 17429->17428 17430->17422 17472 7ff77f651bc8 17431->17472 17531 7ff77f651940 17472->17531 17552 7ff77f650cb8 EnterCriticalSection 17531->17552 17558 7ff77f638675 17557->17558 17559 7ff77f644d18 48 API calls 17558->17559 17560 7ff77f638698 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 17559->17560 17562 7ff77f6479f5 17561->17562 17563 7ff77f6479c2 17561->17563 17562->17224 17563->17562 17564 7ff77f650e54 _wfindfirst32i64 37 API calls 17563->17564 17565 7ff77f6479f1 17564->17565 17565->17562 17566 7ff77f64aec4 _wfindfirst32i64 17 API calls 17565->17566 17567 7ff77f647a25 17566->17567 17569 7ff77f6463b2 17568->17569 17570 7ff77f646344 17568->17570 17605 7ff77f6504a0 17569->17605 17570->17569 17572 7ff77f646349 17570->17572 17573 7ff77f64637e 17572->17573 17574 7ff77f646361 17572->17574 17588 7ff77f64616c GetFullPathNameW 17573->17588 17580 7ff77f6460f8 GetFullPathNameW 17574->17580 17579 7ff77f646376 __std_exception_copy 17579->17224 17581 7ff77f64611e GetLastError 17580->17581 17582 7ff77f646134 17580->17582 17583 7ff77f645438 _fread_nolock 11 API calls 17581->17583 17584 7ff77f646130 17582->17584 17586 7ff77f6454c4 memcpy_s 11 API calls 17582->17586 17585 7ff77f64612b 17583->17585 17584->17579 17587 7ff77f6454c4 memcpy_s 11 API calls 17585->17587 17586->17584 17587->17584 17589 7ff77f64619f GetLastError 17588->17589 17592 7ff77f6461b5 __std_exception_copy 17588->17592 17590 7ff77f645438 _fread_nolock 11 API calls 17589->17590 17591 7ff77f6461ac 17590->17591 17593 7ff77f6454c4 memcpy_s 11 API calls 17591->17593 17594 7ff77f64620f GetFullPathNameW 17592->17594 17595 7ff77f6461b1 17592->17595 17593->17595 17594->17589 17594->17595 17596 7ff77f646244 17595->17596 17600 7ff77f6462b8 memcpy_s 17596->17600 17601 7ff77f64626d memcpy_s 17596->17601 17597 7ff77f6462a1 17600->17579 17601->17597 17601->17600 17603 7ff77f6462da 17601->17603 17603->17600 17604 7ff77f6454c4 memcpy_s 11 API calls 17603->17604 17608 7ff77f6502b0 17605->17608 17609 7ff77f6502db 17608->17609 17610 7ff77f6502f2 17608->17610 17611 7ff77f6454c4 memcpy_s 11 API calls 17609->17611 17612 7ff77f650317 17610->17612 17613 7ff77f6502f6 17610->17613 17627 7ff77f6502e0 17611->17627 17646 7ff77f64f918 17612->17646 17634 7ff77f65041c 17613->17634 17619 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 17633 7ff77f6502eb __std_exception_copy 17619->17633 17623 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17627->17619 17633->17623 17635 7ff77f650466 17634->17635 17636 7ff77f650436 17634->17636 17637 7ff77f650451 17635->17637 17638 7ff77f650471 GetDriveTypeW 17635->17638 17639 7ff77f6454a4 _fread_nolock 11 API calls 17636->17639 17641 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17637->17641 17638->17637 17640 7ff77f65043b 17639->17640 17647 7ff77f63d0e0 memcpy_s 17646->17647 17648 7ff77f64f94e GetCurrentDirectoryW 17647->17648 17649 7ff77f64f98c 17648->17649 17650 7ff77f64f965 17648->17650 17667 7ff77f650cb8 EnterCriticalSection 17660->17667 17669 7ff77f63173e 17668->17669 17670 7ff77f631726 17668->17670 17672 7ff77f631768 17669->17672 17673 7ff77f631744 17669->17673 17671 7ff77f632b30 59 API calls 17670->17671 17674 7ff77f631732 17671->17674 17761 7ff77f637c10 17672->17761 17798 7ff77f6312b0 17673->17798 17674->16497 17679 7ff77f6317b9 17683 7ff77f633fd0 116 API calls 17679->17683 17680 7ff77f63178d 17682 7ff77f632890 59 API calls 17680->17682 17681 7ff77f63175f 17681->16497 17685 7ff77f6317a3 17682->17685 17686 7ff77f6317ce 17683->17686 17684 7ff77f632b30 59 API calls 17684->17681 17685->16497 17687 7ff77f6317ee 17686->17687 17688 7ff77f6317d6 17686->17688 17690 7ff77f640814 73 API calls 17687->17690 17689 7ff77f632b30 59 API calls 17688->17689 17691 7ff77f6317e5 17689->17691 17692 7ff77f6317ff 17690->17692 17711 7ff77f632d86 17710->17711 17712 7ff77f631ef0 49 API calls 17711->17712 17713 7ff77f632db9 17712->17713 17714 7ff77f633e40 49 API calls 17713->17714 17739 7ff77f6330ea 17713->17739 17715 7ff77f632e27 17714->17715 17716 7ff77f633e40 49 API calls 17715->17716 17717 7ff77f632e38 17716->17717 17718 7ff77f632e59 17717->17718 17719 7ff77f632e95 17717->17719 17933 7ff77f6331b0 17718->17933 17721 7ff77f6331b0 75 API calls 17719->17721 17722 7ff77f632e93 17721->17722 17723 7ff77f632f16 17722->17723 17724 7ff77f632ed4 17722->17724 17725 7ff77f6331b0 75 API calls 17723->17725 17941 7ff77f6375a0 17724->17941 17727 7ff77f632f40 17725->17727 17732 7ff77f6331b0 75 API calls 17727->17732 17736 7ff77f632fdc 17727->17736 17734 7ff77f632f72 17732->17734 17734->17736 17735 7ff77f631eb0 59 API calls 17736->17735 17753 7ff77f6330ef 17736->17753 17762 7ff77f637c20 17761->17762 17763 7ff77f631ef0 49 API calls 17762->17763 17764 7ff77f637c61 17763->17764 17778 7ff77f637ce1 17764->17778 17841 7ff77f633f60 17764->17841 17766 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17768 7ff77f631785 17766->17768 17768->17679 17768->17680 17769 7ff77f637d1b 17847 7ff77f6377c0 17769->17847 17771 7ff77f637b60 61 API calls 17779 7ff77f637c92 __std_exception_copy 17771->17779 17773 7ff77f637cd0 17861 7ff77f632c50 17773->17861 17774 7ff77f632c50 59 API calls 17774->17769 17776 7ff77f637d04 17776->17774 17778->17766 17779->17773 17779->17776 17799 7ff77f6312c2 17798->17799 17800 7ff77f633fd0 116 API calls 17799->17800 17801 7ff77f6312f2 17800->17801 17802 7ff77f6312fa 17801->17802 17803 7ff77f631311 17801->17803 17805 7ff77f632b30 59 API calls 17802->17805 17804 7ff77f640814 73 API calls 17803->17804 17806 7ff77f631323 17804->17806 17833 7ff77f63130a __std_exception_copy 17805->17833 17807 7ff77f631327 17806->17807 17808 7ff77f63134d 17806->17808 17809 7ff77f632890 59 API calls 17807->17809 17813 7ff77f631368 17808->17813 17814 7ff77f631390 17808->17814 17810 7ff77f63133e 17809->17810 17812 7ff77f64018c 74 API calls 17810->17812 17811 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17816 7ff77f631454 17811->17816 17812->17833 17817 7ff77f632890 59 API calls 17813->17817 17815 7ff77f6313aa 17814->17815 17828 7ff77f631463 17814->17828 17818 7ff77f631050 98 API calls 17815->17818 17816->17681 17816->17684 17820 7ff77f631383 17817->17820 17821 7ff77f6313bb 17818->17821 17819 7ff77f6313c3 17822 7ff77f64018c 74 API calls 17819->17822 17823 7ff77f64018c 74 API calls 17820->17823 17821->17819 17824 7ff77f6314d2 __std_exception_copy 17821->17824 17825 7ff77f6313cf 17822->17825 17823->17833 17826 7ff77f6404dc _fread_nolock 53 API calls 17826->17828 17828->17819 17828->17826 17830 7ff77f6314bb 17828->17830 17832 7ff77f632890 59 API calls 17830->17832 17832->17824 17833->17811 17842 7ff77f633f6a 17841->17842 17843 7ff77f638ae0 57 API calls 17842->17843 17844 7ff77f633f92 17843->17844 17845 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17844->17845 17846 7ff77f633fba 17845->17846 17846->17769 17846->17771 17846->17779 17848 7ff77f6377d0 17847->17848 17934 7ff77f6331e4 17933->17934 17935 7ff77f644ac4 49 API calls 17934->17935 17936 7ff77f63320a 17935->17936 17937 7ff77f63321b 17936->17937 17993 7ff77f645dec 17936->17993 17939 7ff77f63bcc0 _wfindfirst32i64 8 API calls 17937->17939 17940 7ff77f633239 17939->17940 17940->17722 17942 7ff77f6375ae 17941->17942 17943 7ff77f633fd0 116 API calls 17942->17943 17944 7ff77f6375dd 17943->17944 17994 7ff77f645e09 17993->17994 17995 7ff77f645e15 17993->17995 18010 7ff77f645700 17994->18010 17997 7ff77f644f98 45 API calls 17995->17997 18168 7ff77f6463dc 18167->18168 18169 7ff77f646402 18168->18169 18171 7ff77f646435 18168->18171 18170 7ff77f6454c4 memcpy_s 11 API calls 18169->18170 18172 7ff77f646407 18170->18172 18173 7ff77f646448 18171->18173 18174 7ff77f64643b 18171->18174 18175 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 18172->18175 18186 7ff77f64b1ec 18173->18186 18177 7ff77f6454c4 memcpy_s 11 API calls 18174->18177 18176 7ff77f634029 18175->18176 18176->16550 18177->18176 18199 7ff77f650cb8 EnterCriticalSection 18186->18199 18547 7ff77f6490a0 18546->18547 18550 7ff77f648b7c 18547->18550 18551 7ff77f648b97 18550->18551 18552 7ff77f648bc6 18550->18552 18554 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 18551->18554 18560 7ff77f64536c EnterCriticalSection 18552->18560 18562 7ff77f63ffb1 18561->18562 18563 7ff77f63ff83 18561->18563 18565 7ff77f63ffa3 18562->18565 18571 7ff77f64536c EnterCriticalSection 18562->18571 18564 7ff77f64add8 _invalid_parameter_noinfo 37 API calls 18563->18564 18564->18565 18573 7ff77f633fd0 116 API calls 18572->18573 18574 7ff77f6315c7 18573->18574 18575 7ff77f6315cf 18574->18575 18576 7ff77f6315f0 18574->18576 18577 7ff77f632b30 59 API calls 18575->18577 18578 7ff77f640814 73 API calls 18576->18578 18579 7ff77f6315df 18577->18579 18580 7ff77f631601 18578->18580 18579->16569 18581 7ff77f631621 18580->18581 18582 7ff77f631605 18580->18582 18584 7ff77f631651 18581->18584 18585 7ff77f631631 18581->18585 18583 7ff77f632890 59 API calls 18582->18583 18594 7ff77f63161c __std_exception_copy 18583->18594 18587 7ff77f631666 18584->18587 18592 7ff77f63167d 18584->18592 18586 7ff77f632890 59 API calls 18585->18586 18586->18594 18589 7ff77f631050 98 API calls 18587->18589 18588 7ff77f64018c 74 API calls 18590 7ff77f6316f7 18588->18590 18589->18594 18590->16569 18591 7ff77f6404dc _fread_nolock 53 API calls 18591->18592 18592->18591 18593 7ff77f6316be 18592->18593 18592->18594 18595 7ff77f632890 59 API calls 18593->18595 18594->18588 18595->18594 18597 7ff77f63196f 18596->18597 18599 7ff77f6319d3 18596->18599 18598 7ff77f645070 45 API calls 18597->18598 18597->18599 18598->18597 18599->16575 18601 7ff77f638ae0 57 API calls 18600->18601 18602 7ff77f638277 LoadLibraryExW 18601->18602 18603 7ff77f638294 __std_exception_copy 18602->18603 18603->16596 18663->16613 18664->16615 18666 7ff77f635bd0 18665->18666 18667 7ff77f631ef0 49 API calls 18666->18667 18668 7ff77f635c02 18667->18668 18669 7ff77f635c2b 18668->18669 18670 7ff77f635c0b 18668->18670 18672 7ff77f635c82 18669->18672 18673 7ff77f634050 49 API calls 18669->18673 18671 7ff77f632b30 59 API calls 18670->18671 18675 7ff77f635c21 18671->18675 18674 7ff77f634050 49 API calls 18672->18674 18676 7ff77f635c4c 18673->18676 18677 7ff77f635c9b 18674->18677 18680 7ff77f63bcc0 _wfindfirst32i64 8 API calls 18675->18680 18679 7ff77f635c6a 18676->18679 18683 7ff77f632b30 59 API calls 18676->18683 18678 7ff77f635cb9 18677->18678 18681 7ff77f632b30 59 API calls 18677->18681 18682 7ff77f638260 58 API calls 18678->18682 18684 7ff77f633f60 57 API calls 18679->18684 18685 7ff77f63346e 18680->18685 18681->18678 18686 7ff77f635cc6 18682->18686 18683->18679 18687 7ff77f635c74 18684->18687 18685->16623 18693 7ff77f635d20 18685->18693 18688 7ff77f635ced 18686->18688 18689 7ff77f635ccb 18686->18689 18687->18672 18692 7ff77f638260 58 API calls 18687->18692 18763 7ff77f6351e0 GetProcAddress 18688->18763 18690 7ff77f6329e0 57 API calls 18689->18690 18690->18675 18692->18672 18847 7ff77f634de0 18693->18847 18695 7ff77f635d44 18696 7ff77f635d5d 18695->18696 18697 7ff77f635d4c 18695->18697 18854 7ff77f634530 18696->18854 18698 7ff77f632b30 59 API calls 18697->18698 18764 7ff77f635202 18763->18764 18765 7ff77f635220 GetProcAddress 18763->18765 18767 7ff77f6329e0 57 API calls 18764->18767 18765->18764 18766 7ff77f635245 GetProcAddress 18765->18766 18766->18764 18768 7ff77f63526a GetProcAddress 18766->18768 18769 7ff77f635215 18767->18769 18768->18764 18769->18675 18849 7ff77f634e05 18847->18849 18848 7ff77f634e0d 18848->18695 18849->18848 18852 7ff77f634f9f 18849->18852 18889 7ff77f646fb8 18849->18889 18850 7ff77f63514a __std_exception_copy 18850->18695 18851 7ff77f634250 47 API calls 18851->18852 18852->18850 18852->18851 18890 7ff77f646fe8 18889->18890 18893 7ff77f6464b4 18890->18893 18894 7ff77f6464f7 18893->18894 18895 7ff77f6464e5 18893->18895 19010 7ff77f64b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 19009->19010 19011 7ff77f64a971 19010->19011 19012 7ff77f64aa9c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 19011->19012 19013 7ff77f64a991 19012->19013 15174 7ff77f64fcec 15175 7ff77f64fede 15174->15175 15179 7ff77f64fd2e _isindst 15174->15179 15227 7ff77f6454c4 15175->15227 15179->15175 15180 7ff77f64fdae _isindst 15179->15180 15195 7ff77f656904 15180->15195 15185 7ff77f64ff0a 15239 7ff77f64aec4 IsProcessorFeaturePresent 15185->15239 15192 7ff77f64fe0b 15194 7ff77f64fece 15192->15194 15220 7ff77f656948 15192->15220 15230 7ff77f63bcc0 15194->15230 15196 7ff77f656913 15195->15196 15197 7ff77f64fdcc 15195->15197 15243 7ff77f650cb8 EnterCriticalSection 15196->15243 15202 7ff77f655d08 15197->15202 15203 7ff77f655d11 15202->15203 15207 7ff77f64fde1 15202->15207 15204 7ff77f6454c4 memcpy_s 11 API calls 15203->15204 15205 7ff77f655d16 15204->15205 15244 7ff77f64aea4 15205->15244 15207->15185 15208 7ff77f655d38 15207->15208 15209 7ff77f64fdf2 15208->15209 15210 7ff77f655d41 15208->15210 15209->15185 15214 7ff77f655d68 15209->15214 15211 7ff77f6454c4 memcpy_s 11 API calls 15210->15211 15212 7ff77f655d46 15211->15212 15213 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15212->15213 15213->15209 15215 7ff77f655d71 15214->15215 15217 7ff77f64fe03 15214->15217 15216 7ff77f6454c4 memcpy_s 11 API calls 15215->15216 15218 7ff77f655d76 15216->15218 15217->15185 15217->15192 15219 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15218->15219 15219->15217 15325 7ff77f650cb8 EnterCriticalSection 15220->15325 15326 7ff77f64b888 GetLastError 15227->15326 15229 7ff77f6454cd 15229->15194 15231 7ff77f63bcc9 15230->15231 15232 7ff77f63bcd4 15231->15232 15233 7ff77f63bd20 IsProcessorFeaturePresent 15231->15233 15234 7ff77f63bd38 15233->15234 15343 7ff77f63bf14 RtlCaptureContext 15234->15343 15240 7ff77f64aed7 15239->15240 15348 7ff77f64abd8 15240->15348 15246 7ff77f64ad3c 15244->15246 15247 7ff77f64ad67 15246->15247 15250 7ff77f64add8 15247->15250 15249 7ff77f64ad8e 15258 7ff77f64ab20 15250->15258 15255 7ff77f64ae13 15255->15249 15256 7ff77f64aec4 _wfindfirst32i64 17 API calls 15257 7ff77f64aea3 15256->15257 15259 7ff77f64ab3c GetLastError 15258->15259 15260 7ff77f64ab77 15258->15260 15261 7ff77f64ab4c 15259->15261 15260->15255 15264 7ff77f64ab8c 15260->15264 15267 7ff77f64b950 15261->15267 15265 7ff77f64aba8 GetLastError SetLastError 15264->15265 15266 7ff77f64abc0 15264->15266 15265->15266 15266->15255 15266->15256 15268 7ff77f64b98a FlsSetValue 15267->15268 15269 7ff77f64b96f FlsGetValue 15267->15269 15271 7ff77f64b997 15268->15271 15273 7ff77f64ab67 SetLastError 15268->15273 15270 7ff77f64b984 15269->15270 15269->15273 15270->15268 15284 7ff77f64f158 15271->15284 15273->15260 15275 7ff77f64b9c4 FlsSetValue 15277 7ff77f64b9d0 FlsSetValue 15275->15277 15278 7ff77f64b9e2 15275->15278 15276 7ff77f64b9b4 FlsSetValue 15279 7ff77f64b9bd 15276->15279 15277->15279 15297 7ff77f64b4b8 15278->15297 15291 7ff77f64af0c 15279->15291 15289 7ff77f64f169 memcpy_s 15284->15289 15285 7ff77f64f19e RtlAllocateHeap 15287 7ff77f64b9a6 15285->15287 15285->15289 15286 7ff77f64f1ba 15288 7ff77f6454c4 memcpy_s 10 API calls 15286->15288 15287->15275 15287->15276 15288->15287 15289->15285 15289->15286 15302 7ff77f653c00 15289->15302 15292 7ff77f64af40 15291->15292 15293 7ff77f64af11 RtlRestoreThreadPreferredUILanguages 15291->15293 15292->15273 15293->15292 15294 7ff77f64af2c GetLastError 15293->15294 15295 7ff77f64af39 Concurrency::details::SchedulerProxy::DeleteThis 15294->15295 15296 7ff77f6454c4 memcpy_s 9 API calls 15295->15296 15296->15292 15311 7ff77f64b390 15297->15311 15305 7ff77f653c40 15302->15305 15310 7ff77f650cb8 EnterCriticalSection 15305->15310 15323 7ff77f650cb8 EnterCriticalSection 15311->15323 15327 7ff77f64b8ac 15326->15327 15328 7ff77f64b8c9 FlsSetValue 15326->15328 15327->15328 15340 7ff77f64b8b9 15327->15340 15329 7ff77f64b8db 15328->15329 15328->15340 15330 7ff77f64f158 memcpy_s 5 API calls 15329->15330 15332 7ff77f64b8ea 15330->15332 15331 7ff77f64b935 SetLastError 15331->15229 15333 7ff77f64b908 FlsSetValue 15332->15333 15334 7ff77f64b8f8 FlsSetValue 15332->15334 15336 7ff77f64b914 FlsSetValue 15333->15336 15337 7ff77f64b926 15333->15337 15335 7ff77f64b901 15334->15335 15338 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 15335->15338 15336->15335 15339 7ff77f64b4b8 memcpy_s 5 API calls 15337->15339 15338->15340 15341 7ff77f64b92e 15339->15341 15340->15331 15342 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 15341->15342 15342->15331 15344 7ff77f63bf2e RtlLookupFunctionEntry 15343->15344 15345 7ff77f63bd4b 15344->15345 15346 7ff77f63bf44 RtlVirtualUnwind 15344->15346 15347 7ff77f63bce0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15345->15347 15346->15344 15346->15345 15349 7ff77f64ac12 _wfindfirst32i64 memcpy_s 15348->15349 15350 7ff77f64ac3a RtlCaptureContext RtlLookupFunctionEntry 15349->15350 15351 7ff77f64acaa IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15350->15351 15352 7ff77f64ac74 RtlVirtualUnwind 15350->15352 15353 7ff77f64acfc _wfindfirst32i64 15351->15353 15352->15351 15354 7ff77f63bcc0 _wfindfirst32i64 8 API calls 15353->15354 15355 7ff77f64ad1b GetCurrentProcess TerminateProcess 15354->15355 19147 7ff77f65a96e 19148 7ff77f65a97e 19147->19148 19151 7ff77f645378 LeaveCriticalSection 19148->19151 19765 7ff77f65aaf4 19768 7ff77f645378 LeaveCriticalSection 19765->19768 19019 7ff77f63b4f0 19020 7ff77f63b513 19019->19020 19021 7ff77f63b52f memcpy_s 19019->19021 19022 7ff77f64dbbc 12 API calls 19020->19022 19022->19021 19887 7ff77f64a2e0 19890 7ff77f64a25c 19887->19890 19897 7ff77f650cb8 EnterCriticalSection 19890->19897 19919 7ff77f651ad0 19937 7ff77f650cb8 EnterCriticalSection 19919->19937 15356 7ff77f650f38 15357 7ff77f650f5c 15356->15357 15361 7ff77f650f6c 15356->15361 15358 7ff77f6454c4 memcpy_s 11 API calls 15357->15358 15359 7ff77f650f61 15358->15359 15360 7ff77f65124c 15363 7ff77f6454c4 memcpy_s 11 API calls 15360->15363 15361->15360 15362 7ff77f650f8e 15361->15362 15364 7ff77f650faf 15362->15364 15517 7ff77f6515f4 15362->15517 15365 7ff77f651251 15363->15365 15368 7ff77f651021 15364->15368 15370 7ff77f650fd5 15364->15370 15375 7ff77f651015 15364->15375 15367 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15365->15367 15367->15359 15372 7ff77f64f158 memcpy_s 11 API calls 15368->15372 15385 7ff77f650fe4 15368->15385 15369 7ff77f6510ce 15378 7ff77f6510eb 15369->15378 15386 7ff77f65113d 15369->15386 15532 7ff77f649c50 15370->15532 15376 7ff77f651037 15372->15376 15374 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15374->15359 15375->15369 15375->15385 15538 7ff77f6579fc 15375->15538 15379 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15376->15379 15383 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15378->15383 15384 7ff77f651045 15379->15384 15380 7ff77f650ffd 15380->15375 15387 7ff77f6515f4 45 API calls 15380->15387 15381 7ff77f650fdf 15382 7ff77f6454c4 memcpy_s 11 API calls 15381->15382 15382->15385 15391 7ff77f6510f4 15383->15391 15384->15375 15384->15385 15389 7ff77f64f158 memcpy_s 11 API calls 15384->15389 15385->15374 15386->15385 15388 7ff77f653a4c 40 API calls 15386->15388 15387->15375 15390 7ff77f65117a 15388->15390 15392 7ff77f651067 15389->15392 15393 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15390->15393 15400 7ff77f6510f9 15391->15400 15574 7ff77f653a4c 15391->15574 15395 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15392->15395 15396 7ff77f651184 15393->15396 15395->15375 15396->15385 15396->15400 15397 7ff77f651240 15399 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15397->15399 15398 7ff77f651125 15401 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15398->15401 15399->15359 15400->15397 15400->15400 15402 7ff77f64f158 memcpy_s 11 API calls 15400->15402 15401->15400 15403 7ff77f6511c8 15402->15403 15404 7ff77f6511d9 15403->15404 15405 7ff77f6511d0 15403->15405 15487 7ff77f64aa3c 15404->15487 15406 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15405->15406 15408 7ff77f6511d7 15406->15408 15412 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15408->15412 15410 7ff77f65127b 15414 7ff77f64aec4 _wfindfirst32i64 17 API calls 15410->15414 15411 7ff77f6511f0 15583 7ff77f657b14 15411->15583 15412->15359 15416 7ff77f65128f 15414->15416 15417 7ff77f6512b8 15416->15417 15425 7ff77f6512c8 15416->15425 15420 7ff77f6454c4 memcpy_s 11 API calls 15417->15420 15418 7ff77f651217 15422 7ff77f6454c4 memcpy_s 11 API calls 15418->15422 15419 7ff77f651238 15421 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15419->15421 15449 7ff77f6512bd 15420->15449 15421->15397 15423 7ff77f65121c 15422->15423 15426 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15423->15426 15424 7ff77f6515ab 15428 7ff77f6454c4 memcpy_s 11 API calls 15424->15428 15425->15424 15427 7ff77f6512ea 15425->15427 15426->15408 15429 7ff77f651307 15427->15429 15496 7ff77f6516dc 15427->15496 15430 7ff77f6515b0 15428->15430 15433 7ff77f65137b 15429->15433 15435 7ff77f65132f 15429->15435 15442 7ff77f65136f 15429->15442 15432 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15430->15432 15432->15449 15437 7ff77f6513a3 15433->15437 15443 7ff77f64f158 memcpy_s 11 API calls 15433->15443 15454 7ff77f65133e 15433->15454 15434 7ff77f65142e 15447 7ff77f65144b 15434->15447 15455 7ff77f65149e 15434->15455 15511 7ff77f649c8c 15435->15511 15440 7ff77f64f158 memcpy_s 11 API calls 15437->15440 15437->15442 15437->15454 15448 7ff77f6513c5 15440->15448 15441 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15441->15449 15442->15434 15442->15454 15602 7ff77f6578bc 15442->15602 15444 7ff77f651395 15443->15444 15450 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15444->15450 15445 7ff77f651357 15445->15442 15457 7ff77f6516dc 45 API calls 15445->15457 15446 7ff77f651339 15451 7ff77f6454c4 memcpy_s 11 API calls 15446->15451 15452 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15447->15452 15453 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15448->15453 15450->15437 15451->15454 15456 7ff77f651454 15452->15456 15453->15442 15454->15441 15455->15454 15458 7ff77f653a4c 40 API calls 15455->15458 15461 7ff77f653a4c 40 API calls 15456->15461 15463 7ff77f65145a 15456->15463 15457->15442 15459 7ff77f6514dc 15458->15459 15460 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15459->15460 15462 7ff77f6514e6 15460->15462 15465 7ff77f651486 15461->15465 15462->15454 15462->15463 15464 7ff77f65159f 15463->15464 15468 7ff77f64f158 memcpy_s 11 API calls 15463->15468 15466 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15464->15466 15467 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15465->15467 15466->15449 15467->15463 15469 7ff77f65152b 15468->15469 15470 7ff77f65153c 15469->15470 15471 7ff77f651533 15469->15471 15626 7ff77f650e54 15470->15626 15472 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15471->15472 15474 7ff77f65153a 15472->15474 15478 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15474->15478 15476 7ff77f6515df 15481 7ff77f64aec4 _wfindfirst32i64 17 API calls 15476->15481 15477 7ff77f651552 SetEnvironmentVariableW 15479 7ff77f651597 15477->15479 15480 7ff77f651576 15477->15480 15478->15449 15482 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15479->15482 15483 7ff77f6454c4 memcpy_s 11 API calls 15480->15483 15484 7ff77f6515f3 15481->15484 15482->15464 15485 7ff77f65157b 15483->15485 15486 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15485->15486 15486->15474 15488 7ff77f64aa53 15487->15488 15489 7ff77f64aa49 15487->15489 15490 7ff77f6454c4 memcpy_s 11 API calls 15488->15490 15489->15488 15494 7ff77f64aa6e 15489->15494 15491 7ff77f64aa5a 15490->15491 15492 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15491->15492 15493 7ff77f64aa66 15492->15493 15493->15410 15493->15411 15494->15493 15495 7ff77f6454c4 memcpy_s 11 API calls 15494->15495 15495->15491 15497 7ff77f65171c 15496->15497 15498 7ff77f6516ff 15496->15498 15499 7ff77f64f158 memcpy_s 11 API calls 15497->15499 15498->15429 15506 7ff77f651740 15499->15506 15500 7ff77f6517c4 15635 7ff77f64aa9c 15500->15635 15501 7ff77f6517a1 15503 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15501->15503 15503->15498 15505 7ff77f64f158 memcpy_s 11 API calls 15505->15506 15506->15500 15506->15501 15506->15505 15507 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15506->15507 15508 7ff77f650e54 _wfindfirst32i64 37 API calls 15506->15508 15509 7ff77f6517b0 15506->15509 15507->15506 15508->15506 15510 7ff77f64aec4 _wfindfirst32i64 17 API calls 15509->15510 15510->15500 15512 7ff77f649c9c 15511->15512 15515 7ff77f649ca5 15511->15515 15512->15515 15701 7ff77f64979c 15512->15701 15515->15445 15515->15446 15518 7ff77f651629 15517->15518 15525 7ff77f651611 15517->15525 15519 7ff77f64f158 memcpy_s 11 API calls 15518->15519 15520 7ff77f65164d 15519->15520 15521 7ff77f6516ae 15520->15521 15526 7ff77f64f158 memcpy_s 11 API calls 15520->15526 15527 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15520->15527 15528 7ff77f64aa3c __std_exception_copy 37 API calls 15520->15528 15529 7ff77f6516bd 15520->15529 15531 7ff77f6516d2 15520->15531 15524 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15521->15524 15522 7ff77f64aa9c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15523 7ff77f6516d8 15522->15523 15524->15525 15525->15364 15526->15520 15527->15520 15528->15520 15530 7ff77f64aec4 _wfindfirst32i64 17 API calls 15529->15530 15530->15531 15531->15522 15533 7ff77f649c69 15532->15533 15534 7ff77f649c60 15532->15534 15533->15380 15533->15381 15534->15533 15761 7ff77f649728 15534->15761 15539 7ff77f656bac 15538->15539 15540 7ff77f657a09 15538->15540 15541 7ff77f656bb9 15539->15541 15547 7ff77f656bef 15539->15547 15542 7ff77f644f98 45 API calls 15540->15542 15544 7ff77f6454c4 memcpy_s 11 API calls 15541->15544 15560 7ff77f656b60 15541->15560 15543 7ff77f657a3d 15542->15543 15548 7ff77f657a42 15543->15548 15552 7ff77f657a53 15543->15552 15555 7ff77f657a6a 15543->15555 15549 7ff77f656bc3 15544->15549 15545 7ff77f656c19 15546 7ff77f6454c4 memcpy_s 11 API calls 15545->15546 15550 7ff77f656c1e 15546->15550 15547->15545 15551 7ff77f656c3e 15547->15551 15548->15375 15553 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15549->15553 15554 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15550->15554 15561 7ff77f644f98 45 API calls 15551->15561 15566 7ff77f656c29 15551->15566 15556 7ff77f6454c4 memcpy_s 11 API calls 15552->15556 15557 7ff77f656bce 15553->15557 15554->15566 15558 7ff77f657a74 15555->15558 15559 7ff77f657a86 15555->15559 15562 7ff77f657a58 15556->15562 15557->15375 15563 7ff77f6454c4 memcpy_s 11 API calls 15558->15563 15564 7ff77f657aae 15559->15564 15565 7ff77f657a97 15559->15565 15560->15375 15561->15566 15567 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15562->15567 15568 7ff77f657a79 15563->15568 16049 7ff77f659824 15564->16049 16040 7ff77f656bfc 15565->16040 15566->15375 15567->15548 15571 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15568->15571 15571->15548 15573 7ff77f6454c4 memcpy_s 11 API calls 15573->15548 15575 7ff77f653a8b 15574->15575 15576 7ff77f653a6e 15574->15576 15578 7ff77f653a95 15575->15578 16089 7ff77f658508 15575->16089 15576->15575 15577 7ff77f653a7c 15576->15577 15579 7ff77f6454c4 memcpy_s 11 API calls 15577->15579 16096 7ff77f650ebc 15578->16096 15582 7ff77f653a81 memcpy_s 15579->15582 15582->15398 15584 7ff77f644f98 45 API calls 15583->15584 15585 7ff77f657b7a 15584->15585 15586 7ff77f657b88 15585->15586 16108 7ff77f64f3e4 15585->16108 16111 7ff77f645584 15586->16111 15590 7ff77f657c74 15593 7ff77f657c85 15590->15593 15595 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15590->15595 15591 7ff77f644f98 45 API calls 15592 7ff77f657bf7 15591->15592 15596 7ff77f64f3e4 5 API calls 15592->15596 15598 7ff77f657c00 15592->15598 15594 7ff77f651213 15593->15594 15597 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15593->15597 15594->15418 15594->15419 15595->15593 15596->15598 15597->15594 15599 7ff77f645584 14 API calls 15598->15599 15600 7ff77f657c5b 15599->15600 15600->15590 15601 7ff77f657c63 SetEnvironmentVariableW 15600->15601 15601->15590 15603 7ff77f6578c9 15602->15603 15609 7ff77f6578f6 15602->15609 15604 7ff77f6578ce 15603->15604 15603->15609 15606 7ff77f6454c4 memcpy_s 11 API calls 15604->15606 15605 7ff77f65792e __crtLCMapStringW 15605->15442 15607 7ff77f6578d3 15606->15607 15610 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15607->15610 15608 7ff77f65793a 15612 7ff77f6454c4 memcpy_s 11 API calls 15608->15612 15609->15605 15609->15608 15611 7ff77f657959 15609->15611 15613 7ff77f6578de 15610->15613 15614 7ff77f657963 15611->15614 15615 7ff77f657975 15611->15615 15616 7ff77f65793f 15612->15616 15613->15442 15617 7ff77f6454c4 memcpy_s 11 API calls 15614->15617 15618 7ff77f644f98 45 API calls 15615->15618 15619 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15616->15619 15620 7ff77f657968 15617->15620 15621 7ff77f657982 15618->15621 15619->15605 15622 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15620->15622 15621->15605 16138 7ff77f6593e0 15621->16138 15622->15605 15625 7ff77f6454c4 memcpy_s 11 API calls 15625->15605 15627 7ff77f650e6b 15626->15627 15628 7ff77f650e61 15626->15628 15629 7ff77f6454c4 memcpy_s 11 API calls 15627->15629 15628->15627 15632 7ff77f650e87 15628->15632 15634 7ff77f650e73 15629->15634 15630 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 15631 7ff77f650e7f 15630->15631 15631->15476 15631->15477 15632->15631 15633 7ff77f6454c4 memcpy_s 11 API calls 15632->15633 15633->15634 15634->15630 15644 7ff77f653cc0 15635->15644 15670 7ff77f653c78 15644->15670 15675 7ff77f650cb8 EnterCriticalSection 15670->15675 15702 7ff77f6497b5 15701->15702 15713 7ff77f6497b1 15701->15713 15722 7ff77f6530ac GetEnvironmentStringsW 15702->15722 15705 7ff77f6497ce 15729 7ff77f64991c 15705->15729 15706 7ff77f6497c2 15707 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15706->15707 15707->15713 15710 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15711 7ff77f6497f5 15710->15711 15712 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15711->15712 15712->15713 15713->15515 15714 7ff77f649b5c 15713->15714 15715 7ff77f649b7f 15714->15715 15720 7ff77f649b96 15714->15720 15715->15515 15716 7ff77f64fc00 MultiByteToWideChar _fread_nolock 15716->15720 15717 7ff77f64f158 memcpy_s 11 API calls 15717->15720 15718 7ff77f649c0a 15719 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15718->15719 15719->15715 15720->15715 15720->15716 15720->15717 15720->15718 15721 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15720->15721 15721->15720 15723 7ff77f6497ba 15722->15723 15724 7ff77f6530d0 15722->15724 15723->15705 15723->15706 15748 7ff77f64dbbc 15724->15748 15726 7ff77f653107 memcpy_s 15727 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15726->15727 15728 7ff77f653127 FreeEnvironmentStringsW 15727->15728 15728->15723 15730 7ff77f649944 15729->15730 15731 7ff77f64f158 memcpy_s 11 API calls 15730->15731 15742 7ff77f64997f 15731->15742 15732 7ff77f649987 15733 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15732->15733 15734 7ff77f6497d6 15733->15734 15734->15710 15735 7ff77f649a01 15736 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15735->15736 15736->15734 15737 7ff77f64f158 memcpy_s 11 API calls 15737->15742 15738 7ff77f6499f0 15755 7ff77f649a38 15738->15755 15739 7ff77f650e54 _wfindfirst32i64 37 API calls 15739->15742 15742->15732 15742->15735 15742->15737 15742->15738 15742->15739 15743 7ff77f649a24 15742->15743 15746 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15742->15746 15745 7ff77f64aec4 _wfindfirst32i64 17 API calls 15743->15745 15744 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15744->15732 15747 7ff77f649a36 15745->15747 15746->15742 15749 7ff77f64dc07 15748->15749 15753 7ff77f64dbcb memcpy_s 15748->15753 15750 7ff77f6454c4 memcpy_s 11 API calls 15749->15750 15752 7ff77f64dc05 15750->15752 15751 7ff77f64dbee RtlAllocateHeap 15751->15752 15751->15753 15752->15726 15753->15749 15753->15751 15754 7ff77f653c00 memcpy_s 2 API calls 15753->15754 15754->15753 15756 7ff77f649a3d 15755->15756 15757 7ff77f6499f8 15755->15757 15758 7ff77f649a66 15756->15758 15759 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15756->15759 15757->15744 15760 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15758->15760 15759->15756 15760->15757 15762 7ff77f64973d 15761->15762 15763 7ff77f649741 15761->15763 15762->15533 15776 7ff77f649a7c 15762->15776 15784 7ff77f652c60 15763->15784 15768 7ff77f649753 15770 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15768->15770 15769 7ff77f64975f 15810 7ff77f64980c 15769->15810 15770->15762 15773 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15774 7ff77f649786 15773->15774 15775 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15774->15775 15775->15762 15777 7ff77f649aa5 15776->15777 15781 7ff77f649abe 15776->15781 15777->15533 15778 7ff77f6504c8 WideCharToMultiByte 15778->15781 15779 7ff77f64f158 memcpy_s 11 API calls 15779->15781 15780 7ff77f649b4e 15782 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15780->15782 15781->15777 15781->15778 15781->15779 15781->15780 15783 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15781->15783 15782->15777 15783->15781 15785 7ff77f652c6d 15784->15785 15786 7ff77f649746 15784->15786 15829 7ff77f64b7e4 15785->15829 15790 7ff77f652f9c GetEnvironmentStringsW 15786->15790 15791 7ff77f652fcc 15790->15791 15792 7ff77f64974b 15790->15792 15793 7ff77f6504c8 WideCharToMultiByte 15791->15793 15792->15768 15792->15769 15794 7ff77f65301d 15793->15794 15795 7ff77f653024 FreeEnvironmentStringsW 15794->15795 15796 7ff77f64dbbc _fread_nolock 12 API calls 15794->15796 15795->15792 15797 7ff77f653037 15796->15797 15798 7ff77f653048 15797->15798 15799 7ff77f65303f 15797->15799 15801 7ff77f6504c8 WideCharToMultiByte 15798->15801 15800 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15799->15800 15802 7ff77f653046 15800->15802 15803 7ff77f65306b 15801->15803 15802->15795 15804 7ff77f653079 15803->15804 15805 7ff77f65306f 15803->15805 15807 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15804->15807 15806 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15805->15806 15808 7ff77f653077 FreeEnvironmentStringsW 15806->15808 15807->15808 15808->15792 15811 7ff77f649831 15810->15811 15812 7ff77f64f158 memcpy_s 11 API calls 15811->15812 15822 7ff77f649867 15812->15822 15813 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15814 7ff77f649767 15813->15814 15814->15773 15815 7ff77f6498e2 15816 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15815->15816 15816->15814 15817 7ff77f64f158 memcpy_s 11 API calls 15817->15822 15818 7ff77f6498d1 15819 7ff77f649a38 11 API calls 15818->15819 15821 7ff77f6498d9 15819->15821 15820 7ff77f64aa3c __std_exception_copy 37 API calls 15820->15822 15823 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15821->15823 15822->15815 15822->15817 15822->15818 15822->15820 15824 7ff77f649907 15822->15824 15825 7ff77f64986f 15822->15825 15827 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15822->15827 15823->15825 15826 7ff77f64aec4 _wfindfirst32i64 17 API calls 15824->15826 15825->15813 15828 7ff77f64991a 15826->15828 15827->15822 15830 7ff77f64b7f5 FlsGetValue 15829->15830 15831 7ff77f64b810 FlsSetValue 15829->15831 15832 7ff77f64b80a 15830->15832 15833 7ff77f64b802 15830->15833 15831->15833 15834 7ff77f64b81d 15831->15834 15832->15831 15836 7ff77f64aa9c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15833->15836 15838 7ff77f64b808 15833->15838 15835 7ff77f64f158 memcpy_s 11 API calls 15834->15835 15837 7ff77f64b82c 15835->15837 15839 7ff77f64b885 15836->15839 15840 7ff77f64b84a FlsSetValue 15837->15840 15841 7ff77f64b83a FlsSetValue 15837->15841 15849 7ff77f652934 15838->15849 15843 7ff77f64b868 15840->15843 15844 7ff77f64b856 FlsSetValue 15840->15844 15842 7ff77f64b843 15841->15842 15845 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15842->15845 15846 7ff77f64b4b8 memcpy_s 11 API calls 15843->15846 15844->15842 15845->15833 15847 7ff77f64b870 15846->15847 15848 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15847->15848 15848->15838 15872 7ff77f652ba4 15849->15872 15851 7ff77f652969 15887 7ff77f652634 15851->15887 15854 7ff77f652986 15854->15786 15855 7ff77f64dbbc _fread_nolock 12 API calls 15856 7ff77f652997 15855->15856 15857 7ff77f65299f 15856->15857 15859 7ff77f6529ae 15856->15859 15858 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15857->15858 15858->15854 15859->15859 15894 7ff77f652cdc 15859->15894 15862 7ff77f652aaa 15863 7ff77f6454c4 memcpy_s 11 API calls 15862->15863 15864 7ff77f652aaf 15863->15864 15867 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15864->15867 15865 7ff77f652b05 15866 7ff77f652b6c 15865->15866 15905 7ff77f652464 15865->15905 15871 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15866->15871 15867->15854 15868 7ff77f652ac4 15868->15865 15869 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15868->15869 15869->15865 15871->15854 15873 7ff77f652bc7 15872->15873 15875 7ff77f652bd1 15873->15875 15920 7ff77f650cb8 EnterCriticalSection 15873->15920 15877 7ff77f652c43 15875->15877 15879 7ff77f64aa9c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15875->15879 15877->15851 15881 7ff77f652c5b 15879->15881 15882 7ff77f652cb2 15881->15882 15884 7ff77f64b7e4 50 API calls 15881->15884 15882->15851 15885 7ff77f652c9c 15884->15885 15886 7ff77f652934 65 API calls 15885->15886 15886->15882 15921 7ff77f644f98 15887->15921 15890 7ff77f652654 GetOEMCP 15892 7ff77f65267b 15890->15892 15891 7ff77f652666 15891->15892 15893 7ff77f65266b GetACP 15891->15893 15892->15854 15892->15855 15893->15892 15895 7ff77f652634 47 API calls 15894->15895 15896 7ff77f652d09 15895->15896 15897 7ff77f652e5f 15896->15897 15899 7ff77f652d46 IsValidCodePage 15896->15899 15904 7ff77f652d60 memcpy_s 15896->15904 15898 7ff77f63bcc0 _wfindfirst32i64 8 API calls 15897->15898 15900 7ff77f652aa1 15898->15900 15899->15897 15901 7ff77f652d57 15899->15901 15900->15862 15900->15868 15902 7ff77f652d86 GetCPInfo 15901->15902 15901->15904 15902->15897 15902->15904 15953 7ff77f65274c 15904->15953 16039 7ff77f650cb8 EnterCriticalSection 15905->16039 15922 7ff77f644fb7 15921->15922 15923 7ff77f644fbc 15921->15923 15922->15890 15922->15891 15923->15922 15924 7ff77f64b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15923->15924 15925 7ff77f644fd7 15924->15925 15929 7ff77f64df44 15925->15929 15930 7ff77f64df59 15929->15930 15931 7ff77f644ffa 15929->15931 15930->15931 15937 7ff77f653974 15930->15937 15933 7ff77f64dfb0 15931->15933 15934 7ff77f64dfd8 15933->15934 15935 7ff77f64dfc5 15933->15935 15934->15922 15935->15934 15950 7ff77f652cc0 15935->15950 15938 7ff77f64b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15937->15938 15939 7ff77f653983 15938->15939 15940 7ff77f6539ce 15939->15940 15949 7ff77f650cb8 EnterCriticalSection 15939->15949 15940->15931 15951 7ff77f64b710 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15950->15951 15952 7ff77f652cc9 15951->15952 15954 7ff77f652789 GetCPInfo 15953->15954 15955 7ff77f65287f 15953->15955 15954->15955 15960 7ff77f65279c 15954->15960 15956 7ff77f63bcc0 _wfindfirst32i64 8 API calls 15955->15956 15958 7ff77f65291e 15956->15958 15958->15897 15964 7ff77f6534b0 15960->15964 15965 7ff77f644f98 45 API calls 15964->15965 15966 7ff77f6534f2 15965->15966 15984 7ff77f64fc00 15966->15984 15986 7ff77f64fc09 MultiByteToWideChar 15984->15986 16041 7ff77f656c19 16040->16041 16042 7ff77f656c30 16040->16042 16043 7ff77f6454c4 memcpy_s 11 API calls 16041->16043 16042->16041 16045 7ff77f656c3e 16042->16045 16044 7ff77f656c1e 16043->16044 16046 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 16044->16046 16047 7ff77f644f98 45 API calls 16045->16047 16048 7ff77f656c29 16045->16048 16046->16048 16047->16048 16048->15548 16050 7ff77f644f98 45 API calls 16049->16050 16051 7ff77f659849 16050->16051 16054 7ff77f6594a0 16051->16054 16056 7ff77f6594ee 16054->16056 16055 7ff77f63bcc0 _wfindfirst32i64 8 API calls 16057 7ff77f657ad5 16055->16057 16058 7ff77f659575 16056->16058 16060 7ff77f659560 GetCPInfo 16056->16060 16063 7ff77f659579 16056->16063 16057->15548 16057->15573 16059 7ff77f64fc00 _fread_nolock MultiByteToWideChar 16058->16059 16058->16063 16061 7ff77f65960d 16059->16061 16060->16058 16060->16063 16062 7ff77f64dbbc _fread_nolock 12 API calls 16061->16062 16061->16063 16064 7ff77f659644 16061->16064 16062->16064 16063->16055 16064->16063 16065 7ff77f64fc00 _fread_nolock MultiByteToWideChar 16064->16065 16066 7ff77f6596b2 16065->16066 16067 7ff77f659794 16066->16067 16068 7ff77f64fc00 _fread_nolock MultiByteToWideChar 16066->16068 16067->16063 16069 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16067->16069 16070 7ff77f6596d8 16068->16070 16069->16063 16070->16067 16071 7ff77f64dbbc _fread_nolock 12 API calls 16070->16071 16072 7ff77f659705 16070->16072 16071->16072 16072->16067 16073 7ff77f64fc00 _fread_nolock MultiByteToWideChar 16072->16073 16074 7ff77f65977c 16073->16074 16075 7ff77f65979c 16074->16075 16076 7ff77f659782 16074->16076 16083 7ff77f64f428 16075->16083 16076->16067 16078 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16076->16078 16078->16067 16080 7ff77f6597db 16080->16063 16082 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16080->16082 16081 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16081->16080 16082->16063 16084 7ff77f64f1d0 __crtLCMapStringW 5 API calls 16083->16084 16085 7ff77f64f466 16084->16085 16086 7ff77f64f46e 16085->16086 16087 7ff77f64f690 __crtLCMapStringW 5 API calls 16085->16087 16086->16080 16086->16081 16088 7ff77f64f4d7 CompareStringW 16087->16088 16088->16086 16090 7ff77f65852a HeapSize 16089->16090 16091 7ff77f658511 16089->16091 16092 7ff77f6454c4 memcpy_s 11 API calls 16091->16092 16093 7ff77f658516 16092->16093 16094 7ff77f64aea4 _invalid_parameter_noinfo 37 API calls 16093->16094 16095 7ff77f658521 16094->16095 16095->15578 16097 7ff77f650edb 16096->16097 16098 7ff77f650ed1 16096->16098 16100 7ff77f650ee0 16097->16100 16107 7ff77f650ee7 memcpy_s 16097->16107 16099 7ff77f64dbbc _fread_nolock 12 API calls 16098->16099 16105 7ff77f650ed9 16099->16105 16101 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16100->16101 16101->16105 16102 7ff77f650eed 16104 7ff77f6454c4 memcpy_s 11 API calls 16102->16104 16103 7ff77f650f1a HeapReAlloc 16103->16105 16103->16107 16104->16105 16105->15582 16106 7ff77f653c00 memcpy_s 2 API calls 16106->16107 16107->16102 16107->16103 16107->16106 16109 7ff77f64f1d0 __crtLCMapStringW 5 API calls 16108->16109 16110 7ff77f64f404 16109->16110 16110->15586 16112 7ff77f6455ae 16111->16112 16113 7ff77f6455d2 16111->16113 16117 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16112->16117 16132 7ff77f6455bd 16112->16132 16114 7ff77f64562c 16113->16114 16115 7ff77f6455d7 16113->16115 16116 7ff77f64fc00 _fread_nolock MultiByteToWideChar 16114->16116 16118 7ff77f6455ec 16115->16118 16119 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16115->16119 16115->16132 16126 7ff77f645648 16116->16126 16117->16132 16120 7ff77f64dbbc _fread_nolock 12 API calls 16118->16120 16119->16118 16120->16132 16121 7ff77f64564f GetLastError 16133 7ff77f645438 16121->16133 16122 7ff77f64568a 16127 7ff77f64fc00 _fread_nolock MultiByteToWideChar 16122->16127 16122->16132 16125 7ff77f64567d 16130 7ff77f64dbbc _fread_nolock 12 API calls 16125->16130 16126->16121 16126->16122 16126->16125 16129 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16126->16129 16131 7ff77f6456ce 16127->16131 16128 7ff77f6454c4 memcpy_s 11 API calls 16128->16132 16129->16125 16130->16122 16131->16121 16131->16132 16132->15590 16132->15591 16134 7ff77f64b888 memcpy_s 11 API calls 16133->16134 16135 7ff77f645445 Concurrency::details::SchedulerProxy::DeleteThis 16134->16135 16136 7ff77f64b888 memcpy_s 11 API calls 16135->16136 16137 7ff77f645467 16136->16137 16137->16128 16140 7ff77f659409 __crtLCMapStringW 16138->16140 16139 7ff77f6579be 16139->15605 16139->15625 16140->16139 16141 7ff77f64f428 6 API calls 16140->16141 16141->16139 19014 7ff77f63b240 19015 7ff77f63b26e 19014->19015 19016 7ff77f63b255 19014->19016 19016->19015 19018 7ff77f64dbbc 12 API calls 19016->19018 19017 7ff77f63b2cc 19018->19017 19644 7ff77f651d20 19655 7ff77f657cb4 19644->19655 19656 7ff77f657cc1 19655->19656 19657 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19656->19657 19658 7ff77f657cdd 19656->19658 19657->19656 19659 7ff77f64af0c Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19658->19659 19660 7ff77f651d29 19658->19660 19659->19658 19661 7ff77f650cb8 EnterCriticalSection 19660->19661

                                                                            Executed Functions

                                                                            Function 00007FF77F656370 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 133 7ff77f656370-7ff77f6563ab call 7ff77f655cf8 call 7ff77f655d00 call 7ff77f655d68 140 7ff77f6565d5-7ff77f656621 call 7ff77f64aec4 call 7ff77f655cf8 call 7ff77f655d00 call 7ff77f655d68 133->140 141 7ff77f6563b1-7ff77f6563bc call 7ff77f655d08 133->141 168 7ff77f656627-7ff77f656632 call 7ff77f655d08 140->168 169 7ff77f65675f-7ff77f6567cd call 7ff77f64aec4 call 7ff77f651be8 140->169 141->140 146 7ff77f6563c2-7ff77f6563cc 141->146 148 7ff77f6563ee-7ff77f6563f2 146->148 149 7ff77f6563ce-7ff77f6563d1 146->149 152 7ff77f6563f5-7ff77f6563fd 148->152 151 7ff77f6563d4-7ff77f6563df 149->151 155 7ff77f6563ea-7ff77f6563ec 151->155 156 7ff77f6563e1-7ff77f6563e8 151->156 152->152 157 7ff77f6563ff-7ff77f656412 call 7ff77f64dbbc 152->157 155->148 159 7ff77f65641b-7ff77f656429 155->159 156->151 156->155 164 7ff77f65642a-7ff77f656436 call 7ff77f64af0c 157->164 165 7ff77f656414-7ff77f656416 call 7ff77f64af0c 157->165 173 7ff77f65643d-7ff77f656445 164->173 165->159 168->169 177 7ff77f656638-7ff77f656643 call 7ff77f655d38 168->177 186 7ff77f6567db-7ff77f6567de 169->186 187 7ff77f6567cf-7ff77f6567d6 169->187 173->173 176 7ff77f656447-7ff77f656458 call 7ff77f650e54 173->176 176->140 185 7ff77f65645e-7ff77f6564b4 call 7ff77f63d0e0 * 4 call 7ff77f65628c 176->185 177->169 188 7ff77f656649-7ff77f65666c call 7ff77f64af0c GetTimeZoneInformation 177->188 245 7ff77f6564b6-7ff77f6564ba 185->245 191 7ff77f656815-7ff77f656828 call 7ff77f64dbbc 186->191 192 7ff77f6567e0 186->192 190 7ff77f65686b-7ff77f65686e 187->190 203 7ff77f656734-7ff77f65675e call 7ff77f655cf0 call 7ff77f655ce0 call 7ff77f655ce8 188->203 204 7ff77f656672-7ff77f656693 188->204 194 7ff77f6567e3 call 7ff77f6565ec 190->194 195 7ff77f656874-7ff77f65687c call 7ff77f656370 190->195 207 7ff77f65682a 191->207 208 7ff77f656833-7ff77f65684e call 7ff77f651be8 191->208 192->194 210 7ff77f6567e8-7ff77f656814 call 7ff77f64af0c call 7ff77f63bcc0 194->210 195->210 211 7ff77f65669e-7ff77f6566a5 204->211 212 7ff77f656695-7ff77f65669b 204->212 216 7ff77f65682c-7ff77f656831 call 7ff77f64af0c 207->216 232 7ff77f656855-7ff77f656867 call 7ff77f64af0c 208->232 233 7ff77f656850-7ff77f656853 208->233 213 7ff77f6566a7-7ff77f6566af 211->213 214 7ff77f6566b9 211->214 212->211 213->214 222 7ff77f6566b1-7ff77f6566b7 213->222 220 7ff77f6566bb-7ff77f65672f call 7ff77f63d0e0 * 4 call 7ff77f6531cc call 7ff77f656884 * 2 214->220 216->192 220->203 222->220 232->190 233->216 247 7ff77f6564bc 245->247 248 7ff77f6564c0-7ff77f6564c4 245->248 247->248 248->245 250 7ff77f6564c6-7ff77f6564eb call 7ff77f64706c 248->250 256 7ff77f6564ee-7ff77f6564f2 250->256 258 7ff77f6564f4-7ff77f6564ff 256->258 259 7ff77f656501-7ff77f656505 256->259 258->259 261 7ff77f656507-7ff77f65650b 258->261 259->256 263 7ff77f65658c-7ff77f656590 261->263 264 7ff77f65650d-7ff77f656535 call 7ff77f64706c 261->264 266 7ff77f656597-7ff77f6565a4 263->266 267 7ff77f656592-7ff77f656594 263->267 272 7ff77f656537 264->272 273 7ff77f656553-7ff77f656557 264->273 270 7ff77f6565a6-7ff77f6565bc call 7ff77f65628c 266->270 271 7ff77f6565bf-7ff77f6565ce call 7ff77f655cf0 call 7ff77f655ce0 266->271 267->266 270->271 271->140 277 7ff77f65653a-7ff77f656541 272->277 273->263 279 7ff77f656559-7ff77f656577 call 7ff77f64706c 273->279 277->273 280 7ff77f656543-7ff77f656551 277->280 285 7ff77f656583-7ff77f65658a 279->285 280->273 280->277 285->263 286 7ff77f656579-7ff77f65657d 285->286 286->263 287 7ff77f65657f 286->287 287->285
                                                                            APIs
                                                                            • _get_daylight.LIBCMT ref: 00007FF77F6563B5
                                                                              • Part of subcall function 00007FF77F655D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77F655D1C
                                                                              • Part of subcall function 00007FF77F64AF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF77F653392,?,?,?,00007FF77F6533CF,?,?,00000000,00007FF77F653895,?,?,00000000,00007FF77F6537C7), ref: 00007FF77F64AF22
                                                                              • Part of subcall function 00007FF77F64AF0C: GetLastError.KERNEL32(?,?,?,00007FF77F653392,?,?,?,00007FF77F6533CF,?,?,00000000,00007FF77F653895,?,?,00000000,00007FF77F6537C7), ref: 00007FF77F64AF2C
                                                                              • Part of subcall function 00007FF77F64AEC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF77F64AEA3,?,?,?,?,?,00007FF77F6430CC), ref: 00007FF77F64AECD
                                                                              • Part of subcall function 00007FF77F64AEC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF77F64AEA3,?,?,?,?,?,00007FF77F6430CC), ref: 00007FF77F64AEF2
                                                                            • _get_daylight.LIBCMT ref: 00007FF77F6563A4
                                                                              • Part of subcall function 00007FF77F655D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77F655D7C
                                                                            • _get_daylight.LIBCMT ref: 00007FF77F65661A
                                                                            • _get_daylight.LIBCMT ref: 00007FF77F65662B
                                                                            • _get_daylight.LIBCMT ref: 00007FF77F65663C
                                                                            • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF77F65687C), ref: 00007FF77F656663
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
                                                                            • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                            • API String ID: 1458651798-690618308
                                                                            • Opcode ID: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
                                                                            • Instruction ID: 4483e6e5eba79f5692baf132955f612569c283dd7c8f6ba370aeee6c39bc2c09
                                                                            • Opcode Fuzzy Hash: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
                                                                            • Instruction Fuzzy Hash: 19D1A163B3828286E720BF25D6511FAA36AEF44794FC08136EA0DD7695DF3DE441C7A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6572BC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 318 7ff77f6572bc-7ff77f65732f call 7ff77f656ff0 321 7ff77f657349-7ff77f657353 call 7ff77f648434 318->321 322 7ff77f657331-7ff77f65733a call 7ff77f6454a4 318->322 327 7ff77f65736e-7ff77f6573d7 CreateFileW 321->327 328 7ff77f657355-7ff77f65736c call 7ff77f6454a4 call 7ff77f6454c4 321->328 329 7ff77f65733d-7ff77f657344 call 7ff77f6454c4 322->329 331 7ff77f6573d9-7ff77f6573df 327->331 332 7ff77f657454-7ff77f65745f GetFileType 327->332 328->329 340 7ff77f65768a-7ff77f6576aa 329->340 337 7ff77f657421-7ff77f65744f GetLastError call 7ff77f645438 331->337 338 7ff77f6573e1-7ff77f6573e5 331->338 334 7ff77f657461-7ff77f65749c GetLastError call 7ff77f645438 CloseHandle 332->334 335 7ff77f6574b2-7ff77f6574b9 332->335 334->329 352 7ff77f6574a2-7ff77f6574ad call 7ff77f6454c4 334->352 343 7ff77f6574bb-7ff77f6574bf 335->343 344 7ff77f6574c1-7ff77f6574c4 335->344 337->329 338->337 345 7ff77f6573e7-7ff77f65741f CreateFileW 338->345 349 7ff77f6574ca-7ff77f65751f call 7ff77f64834c 343->349 344->349 350 7ff77f6574c6 344->350 345->332 345->337 357 7ff77f65753e-7ff77f65756f call 7ff77f656d70 349->357 358 7ff77f657521-7ff77f65752d call 7ff77f6571f8 349->358 350->349 352->329 364 7ff77f657575-7ff77f6575b7 357->364 365 7ff77f657571-7ff77f657573 357->365 358->357 363 7ff77f65752f 358->363 366 7ff77f657531-7ff77f657539 call 7ff77f64b084 363->366 367 7ff77f6575d9-7ff77f6575e4 364->367 368 7ff77f6575b9-7ff77f6575bd 364->368 365->366 366->340 371 7ff77f657688 367->371 372 7ff77f6575ea-7ff77f6575ee 367->372 368->367 370 7ff77f6575bf-7ff77f6575d4 368->370 370->367 371->340 372->371 374 7ff77f6575f4-7ff77f657639 CloseHandle CreateFileW 372->374 375 7ff77f65763b-7ff77f657669 GetLastError call 7ff77f645438 call 7ff77f648574 374->375 376 7ff77f65766e-7ff77f657683 374->376 375->376 376->371
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                            • String ID:
                                                                            • API String ID: 1617910340-0
                                                                            • Opcode ID: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
                                                                            • Instruction ID: 39fe1db9887fa922c808c0c12efdbe0b7d737a52add6a5b4c50828af1866d461
                                                                            • Opcode Fuzzy Hash: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
                                                                            • Instruction Fuzzy Hash: 65C1C133B34A8585EB10EF68C5801BD7766FB48BA8B810235DE1EAB794CF38D555C3A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F637950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            • GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF77F63154F), ref: 00007FF77F6379E7
                                                                              • Part of subcall function 00007FF77F637B60: GetEnvironmentVariableW.KERNEL32(00007FF77F633A1F), ref: 00007FF77F637B9A
                                                                              • Part of subcall function 00007FF77F637B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF77F637BB7
                                                                              • Part of subcall function 00007FF77F647DEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77F647E05
                                                                            • SetEnvironmentVariableW.KERNEL32 ref: 00007FF77F637AA1
                                                                              • Part of subcall function 00007FF77F632B30: MessageBoxW.USER32 ref: 00007FF77F632C05
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                            • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                            • API String ID: 3752271684-1116378104
                                                                            • Opcode ID: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
                                                                            • Instruction ID: 4b1550412e47a1e3c74f76af9307f826bc5a7fbe09345c829e084d9bda0d2453
                                                                            • Opcode Fuzzy Hash: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
                                                                            • Instruction Fuzzy Hash: CE513E53B3D6C341F954B6669A152FBD25B6F8ABC0F844431ED0EC77D6EE2CE50182A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6565EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 766 7ff77f6565ec-7ff77f656621 call 7ff77f655cf8 call 7ff77f655d00 call 7ff77f655d68 773 7ff77f656627-7ff77f656632 call 7ff77f655d08 766->773 774 7ff77f65675f-7ff77f6567cd call 7ff77f64aec4 call 7ff77f651be8 766->774 773->774 779 7ff77f656638-7ff77f656643 call 7ff77f655d38 773->779 785 7ff77f6567db-7ff77f6567de 774->785 786 7ff77f6567cf-7ff77f6567d6 774->786 779->774 787 7ff77f656649-7ff77f65666c call 7ff77f64af0c GetTimeZoneInformation 779->787 789 7ff77f656815-7ff77f656828 call 7ff77f64dbbc 785->789 790 7ff77f6567e0 785->790 788 7ff77f65686b-7ff77f65686e 786->788 799 7ff77f656734-7ff77f65675e call 7ff77f655cf0 call 7ff77f655ce0 call 7ff77f655ce8 787->799 800 7ff77f656672-7ff77f656693 787->800 792 7ff77f6567e3 call 7ff77f6565ec 788->792 793 7ff77f656874-7ff77f65687c call 7ff77f656370 788->793 803 7ff77f65682a 789->803 804 7ff77f656833-7ff77f65684e call 7ff77f651be8 789->804 790->792 805 7ff77f6567e8-7ff77f656814 call 7ff77f64af0c call 7ff77f63bcc0 792->805 793->805 806 7ff77f65669e-7ff77f6566a5 800->806 807 7ff77f656695-7ff77f65669b 800->807 811 7ff77f65682c-7ff77f656831 call 7ff77f64af0c 803->811 824 7ff77f656855-7ff77f656867 call 7ff77f64af0c 804->824 825 7ff77f656850-7ff77f656853 804->825 808 7ff77f6566a7-7ff77f6566af 806->808 809 7ff77f6566b9 806->809 807->806 808->809 816 7ff77f6566b1-7ff77f6566b7 808->816 814 7ff77f6566bb-7ff77f65672f call 7ff77f63d0e0 * 4 call 7ff77f6531cc call 7ff77f656884 * 2 809->814 811->790 814->799 816->814 824->788 825->811
                                                                            APIs
                                                                            • _get_daylight.LIBCMT ref: 00007FF77F65661A
                                                                              • Part of subcall function 00007FF77F655D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77F655D7C
                                                                            • _get_daylight.LIBCMT ref: 00007FF77F65662B
                                                                              • Part of subcall function 00007FF77F655D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77F655D1C
                                                                            • _get_daylight.LIBCMT ref: 00007FF77F65663C
                                                                              • Part of subcall function 00007FF77F655D38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77F655D4C
                                                                              • Part of subcall function 00007FF77F64AF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF77F653392,?,?,?,00007FF77F6533CF,?,?,00000000,00007FF77F653895,?,?,00000000,00007FF77F6537C7), ref: 00007FF77F64AF22
                                                                              • Part of subcall function 00007FF77F64AF0C: GetLastError.KERNEL32(?,?,?,00007FF77F653392,?,?,?,00007FF77F6533CF,?,?,00000000,00007FF77F653895,?,?,00000000,00007FF77F6537C7), ref: 00007FF77F64AF2C
                                                                            • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF77F65687C), ref: 00007FF77F656663
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
                                                                            • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                            • API String ID: 2248164782-690618308
                                                                            • Opcode ID: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
                                                                            • Instruction ID: c11fe107532a720f6194cfc1f31fb60d339d3cbcf10b67636f67baad140c44b8
                                                                            • Opcode Fuzzy Hash: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
                                                                            • Instruction Fuzzy Hash: 5D517373B3868286E710FF21D6915EAA36ABF48784F804136EA1DD3695DF3CE440C7A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F650F38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentFeaturePresentProcessProcessor
                                                                            • String ID:
                                                                            • API String ID: 1010374628-0
                                                                            • Opcode ID: 56fc9483a7ee5f7c3b0f0c385ec77c25c48e109e1d7b119d188e83d6dac66eb5
                                                                            • Instruction ID: 2466a2110e818ec1dda5c043c12aaa26b4380b7680a99dcbea633092eea74874
                                                                            • Opcode Fuzzy Hash: 56fc9483a7ee5f7c3b0f0c385ec77c25c48e109e1d7b119d188e83d6dac66eb5
                                                                            • Instruction Fuzzy Hash: C8028FA3B3D6C350EA51BB219A102FBA68EAF41BA0F844534DD6DD72D1DE3CE40183B0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F631710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 0 7ff77f631710-7ff77f631724 1 7ff77f63173e-7ff77f631742 0->1 2 7ff77f631726-7ff77f63173d call 7ff77f632b30 0->2 4 7ff77f631768-7ff77f63178b call 7ff77f637c10 1->4 5 7ff77f631744-7ff77f63174d call 7ff77f6312b0 1->5 11 7ff77f6317b9-7ff77f6317d4 call 7ff77f633fd0 4->11 12 7ff77f63178d-7ff77f6317b8 call 7ff77f632890 4->12 13 7ff77f63175f-7ff77f631767 5->13 14 7ff77f63174f-7ff77f63175a call 7ff77f632b30 5->14 20 7ff77f6317ee-7ff77f631801 call 7ff77f640814 11->20 21 7ff77f6317d6-7ff77f6317e9 call 7ff77f632b30 11->21 14->13 27 7ff77f631823-7ff77f631827 20->27 28 7ff77f631803-7ff77f63181e call 7ff77f632890 20->28 26 7ff77f63192f-7ff77f631932 call 7ff77f64018c 21->26 33 7ff77f631937-7ff77f63194e 26->33 30 7ff77f631829-7ff77f631835 call 7ff77f631050 27->30 31 7ff77f631841-7ff77f631861 call 7ff77f644f90 27->31 37 7ff77f631927-7ff77f63192a call 7ff77f64018c 28->37 38 7ff77f63183a-7ff77f63183c 30->38 40 7ff77f631882-7ff77f631888 31->40 41 7ff77f631863-7ff77f63187d call 7ff77f632890 31->41 37->26 38->37 44 7ff77f63188e-7ff77f631897 40->44 45 7ff77f631915-7ff77f631918 call 7ff77f644f7c 40->45 49 7ff77f63191d-7ff77f631922 41->49 48 7ff77f6318a0-7ff77f6318c2 call 7ff77f6404dc 44->48 45->49 52 7ff77f6318f5-7ff77f6318fc 48->52 53 7ff77f6318c4-7ff77f6318dc call 7ff77f640c1c 48->53 49->37 55 7ff77f631903-7ff77f63190b call 7ff77f632890 52->55 58 7ff77f6318de-7ff77f6318e1 53->58 59 7ff77f6318e5-7ff77f6318f3 53->59 62 7ff77f631910 55->62 58->48 61 7ff77f6318e3 58->61 59->55 61->62 62->45
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Message
                                                                            • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                                                            • API String ID: 2030045667-3833288071
                                                                            • Opcode ID: 63bd0fd15ad53b5fcf8ce689630e928456d443b1d30c8c9be215c0fb2b82a418
                                                                            • Instruction ID: 812b9367da599dfa33a52c2375966d6aa1fc9f4cda698a89516dcc589dfbbc67
                                                                            • Opcode Fuzzy Hash: 63bd0fd15ad53b5fcf8ce689630e928456d443b1d30c8c9be215c0fb2b82a418
                                                                            • Instruction Fuzzy Hash: 94518363F386C286EA10BB15EA501FBA35ABF45794FC44431DE4C87696DE3CE24587A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F638950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            • GetCurrentProcess.KERNEL32(0000000100000001,00007FF77F63414C,00007FF77F637911,?,00007FF77F637D26,?,00007FF77F631785), ref: 00007FF77F638990
                                                                            • OpenProcessToken.ADVAPI32(?,00007FF77F637D26,?,00007FF77F631785), ref: 00007FF77F6389A1
                                                                            • GetTokenInformation.KERNELBASE(?,00007FF77F637D26,?,00007FF77F631785), ref: 00007FF77F6389C3
                                                                            • GetLastError.KERNEL32(?,00007FF77F637D26,?,00007FF77F631785), ref: 00007FF77F6389CD
                                                                            • GetTokenInformation.KERNELBASE(?,00007FF77F637D26,?,00007FF77F631785), ref: 00007FF77F638A0A
                                                                            • ConvertSidToStringSidW.ADVAPI32 ref: 00007FF77F638A1C
                                                                            • FindCloseChangeNotification.KERNELBASE(?,00007FF77F637D26,?,00007FF77F631785), ref: 00007FF77F638A34
                                                                            • LocalFree.KERNEL32(?,00007FF77F637D26,?,00007FF77F631785), ref: 00007FF77F638A66
                                                                            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF77F638A8D
                                                                            • CreateDirectoryW.KERNELBASE(?,00007FF77F637D26,?,00007FF77F631785), ref: 00007FF77F638A9E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen
                                                                            • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                            • API String ID: 2187719417-2855260032
                                                                            • Opcode ID: 41841eecf5aa058ef8b67c6dd7206db1a030f8b14ef4ded43aa588cc0bf062c9
                                                                            • Instruction ID: 258738cada37824e53fc91a1c13c9c1b870520f27ede8dd301b19c8113fcdfbb
                                                                            • Opcode Fuzzy Hash: 41841eecf5aa058ef8b67c6dd7206db1a030f8b14ef4ded43aa588cc0bf062c9
                                                                            • Instruction Fuzzy Hash: 7A41703363C6C682EA50AF65E5446EBA366FF84794F840231EA5E876D5DF3CE4088790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F631AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _fread_nolock$Message
                                                                            • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                            • API String ID: 677216364-1384898525
                                                                            • Opcode ID: d63243b9330034a4dc846e535468db700aa82ebded5b09618c5243df738cf1ab
                                                                            • Instruction ID: 8740fdb73b59caf905f48f9ee446d7119914eb2c9ea2cf55c6a33f7d6487efe5
                                                                            • Opcode Fuzzy Hash: d63243b9330034a4dc846e535468db700aa82ebded5b09618c5243df738cf1ab
                                                                            • Instruction Fuzzy Hash: EB516D72B3868286EB14FF28D6401FAB3AAEF48B94B954135D90CC7795DE3CE5408794
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F638080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                            • String ID: CreateProcessW$Error creating child process!
                                                                            • API String ID: 2895956056-3524285272
                                                                            • Opcode ID: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
                                                                            • Instruction ID: edd00b729da263a70ac0d1539f780ef555fe13b15b7ab6e09851b245f054af34
                                                                            • Opcode Fuzzy Hash: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
                                                                            • Instruction Fuzzy Hash: 79412133A286C182DA20BB64E6552EBE369FF94364F800335E6AD836D5DF7CD1448B50
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F631000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 381 7ff77f631000-7ff77f6339d6 call 7ff77f63ff60 call 7ff77f63ff58 call 7ff77f6386b0 call 7ff77f63ff58 call 7ff77f63bc60 call 7ff77f6452f0 call 7ff77f645ef8 call 7ff77f631eb0 399 7ff77f6339dc-7ff77f6339ec call 7ff77f633ec0 381->399 400 7ff77f633ad2 381->400 399->400 405 7ff77f6339f2-7ff77f633a05 call 7ff77f633d90 399->405 402 7ff77f633ad7-7ff77f633af7 call 7ff77f63bcc0 400->402 405->400 409 7ff77f633a0b-7ff77f633a32 call 7ff77f637b60 405->409 412 7ff77f633a74-7ff77f633a9c call 7ff77f638040 call 7ff77f631cb0 409->412 413 7ff77f633a34-7ff77f633a43 call 7ff77f637b60 409->413 423 7ff77f633b71-7ff77f633b82 412->423 424 7ff77f633aa2-7ff77f633ab8 call 7ff77f631cb0 412->424 413->412 419 7ff77f633a45-7ff77f633a4b 413->419 421 7ff77f633a57-7ff77f633a71 call 7ff77f644f7c call 7ff77f638040 419->421 422 7ff77f633a4d-7ff77f633a55 419->422 421->412 422->421 427 7ff77f633b9e-7ff77f633ba1 423->427 428 7ff77f633b84-7ff77f633b8b 423->428 440 7ff77f633aba-7ff77f633acd call 7ff77f632b30 424->440 441 7ff77f633af8-7ff77f633afb 424->441 432 7ff77f633bb7-7ff77f633bcf call 7ff77f638ae0 427->432 433 7ff77f633ba3-7ff77f633ba9 427->433 428->427 430 7ff77f633b8d-7ff77f633b90 call 7ff77f6314f0 428->430 443 7ff77f633b95-7ff77f633b98 430->443 448 7ff77f633bd1-7ff77f633bdd call 7ff77f632b30 432->448 449 7ff77f633be2-7ff77f633be9 SetDllDirectoryW 432->449 437 7ff77f633bab-7ff77f633bb5 433->437 438 7ff77f633bef-7ff77f633bfc call 7ff77f636de0 433->438 437->432 437->438 451 7ff77f633c47-7ff77f633c4c call 7ff77f636d60 438->451 452 7ff77f633bfe-7ff77f633c0b call 7ff77f636a90 438->452 440->400 441->423 442 7ff77f633afd-7ff77f633b14 call 7ff77f633fd0 441->442 456 7ff77f633b1b-7ff77f633b47 call 7ff77f6382b0 442->456 457 7ff77f633b16-7ff77f633b19 442->457 443->400 443->427 448->400 449->438 460 7ff77f633c51-7ff77f633c54 451->460 452->451 466 7ff77f633c0d-7ff77f633c1c call 7ff77f6365f0 452->466 456->423 472 7ff77f633b49-7ff77f633b51 call 7ff77f64018c 456->472 462 7ff77f633b56-7ff77f633b6c call 7ff77f632b30 457->462 464 7ff77f633c5a-7ff77f633c67 460->464 465 7ff77f633d06-7ff77f633d15 call 7ff77f6334c0 460->465 462->400 469 7ff77f633c70-7ff77f633c7a 464->469 465->400 483 7ff77f633d1b-7ff77f633d4d call 7ff77f637fd0 call 7ff77f637b60 call 7ff77f633620 call 7ff77f638080 465->483 481 7ff77f633c3d-7ff77f633c42 call 7ff77f636840 466->481 482 7ff77f633c1e-7ff77f633c2a call 7ff77f636570 466->482 474 7ff77f633c7c-7ff77f633c81 469->474 475 7ff77f633c83-7ff77f633c85 469->475 472->462 474->469 474->475 479 7ff77f633c87-7ff77f633caa call 7ff77f631ef0 475->479 480 7ff77f633cd1-7ff77f633d01 call 7ff77f633620 call 7ff77f633460 call 7ff77f633610 call 7ff77f636840 call 7ff77f636d60 475->480 479->400 494 7ff77f633cb0-7ff77f633cba 479->494 480->402 481->451 482->481 495 7ff77f633c2c-7ff77f633c3b call 7ff77f636c30 482->495 509 7ff77f633d52-7ff77f633d6f call 7ff77f636840 call 7ff77f636d60 483->509 498 7ff77f633cc0-7ff77f633ccf 494->498 495->460 498->480 498->498 517 7ff77f633d7d-7ff77f633d87 call 7ff77f631e80 509->517 518 7ff77f633d71-7ff77f633d78 call 7ff77f637d40 509->518 517->402 518->517
                                                                            APIs
                                                                              • Part of subcall function 00007FF77F633EC0: GetModuleFileNameW.KERNEL32(?,00007FF77F6339EA), ref: 00007FF77F633EF1
                                                                            • SetDllDirectoryW.KERNEL32 ref: 00007FF77F633BE9
                                                                              • Part of subcall function 00007FF77F637B60: GetEnvironmentVariableW.KERNEL32(00007FF77F633A1F), ref: 00007FF77F637B9A
                                                                              • Part of subcall function 00007FF77F637B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF77F637BB7
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                            • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                            • API String ID: 2344891160-3602715111
                                                                            • Opcode ID: 961709e27c457eb7e7d62568ba5cf74f7b3efaffa6cfd352c1cb815f9f4d264f
                                                                            • Instruction ID: 45fa2673453055d0925c56d7c479ddb1281c6ffb318a128df877433cc0256bf1
                                                                            • Opcode Fuzzy Hash: 961709e27c457eb7e7d62568ba5cf74f7b3efaffa6cfd352c1cb815f9f4d264f
                                                                            • Instruction Fuzzy Hash: 38B1A223B3C6C641EA25BB2197522FF926ABF45784FC00131EA4DC7696EF2CE505D7A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F631050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 522 7ff77f631050-7ff77f6310ab call 7ff77f63b4e0 525 7ff77f6310ad-7ff77f6310d2 call 7ff77f632b30 522->525 526 7ff77f6310d3-7ff77f6310eb call 7ff77f644f90 522->526 531 7ff77f631109-7ff77f631119 call 7ff77f644f90 526->531 532 7ff77f6310ed-7ff77f631104 call 7ff77f632890 526->532 538 7ff77f631137-7ff77f631147 531->538 539 7ff77f63111b-7ff77f631132 call 7ff77f632890 531->539 537 7ff77f63126c-7ff77f631281 call 7ff77f63b1c0 call 7ff77f644f7c * 2 532->537 555 7ff77f631286-7ff77f6312a0 537->555 542 7ff77f631150-7ff77f631175 call 7ff77f6404dc 538->542 539->537 548 7ff77f63125e 542->548 549 7ff77f63117b-7ff77f631185 call 7ff77f640250 542->549 553 7ff77f631264 548->553 549->548 556 7ff77f63118b-7ff77f631197 549->556 553->537 557 7ff77f6311a0-7ff77f6311c8 call 7ff77f639990 556->557 560 7ff77f6311ca-7ff77f6311cd 557->560 561 7ff77f631241-7ff77f63125c call 7ff77f632b30 557->561 562 7ff77f63123c 560->562 563 7ff77f6311cf-7ff77f6311d9 560->563 561->553 562->561 565 7ff77f6311db-7ff77f6311e8 call 7ff77f640c1c 563->565 566 7ff77f631203-7ff77f631206 563->566 573 7ff77f6311ed-7ff77f6311f0 565->573 568 7ff77f631219-7ff77f63121e 566->568 569 7ff77f631208-7ff77f631216 call 7ff77f63ca40 566->569 568->557 572 7ff77f631220-7ff77f631223 568->572 569->568 575 7ff77f631237-7ff77f63123a 572->575 576 7ff77f631225-7ff77f631228 572->576 577 7ff77f6311fe-7ff77f631201 573->577 578 7ff77f6311f2-7ff77f6311fc call 7ff77f640250 573->578 575->553 576->561 579 7ff77f63122a-7ff77f631232 576->579 577->561 578->568 578->577 579->542
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Message
                                                                            • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                            • API String ID: 2030045667-1655038675
                                                                            • Opcode ID: db045d498fcca267f3ebd6430b41e695cb0f7c59426cc2ae9814ddbf5fd6d767
                                                                            • Instruction ID: e3bf9f1ff1733793c8b1e226a37fe2d39c7e469e91d1a61b96b209a84cca2725
                                                                            • Opcode Fuzzy Hash: db045d498fcca267f3ebd6430b41e695cb0f7c59426cc2ae9814ddbf5fd6d767
                                                                            • Instruction Fuzzy Hash: ED51C163A386C285EA60BB15A6403FBA29ABF847A4F844131ED4DC7785EE3CE545C790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64C01C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 653 7ff77f64c01c-7ff77f64c042 654 7ff77f64c05d-7ff77f64c061 653->654 655 7ff77f64c044-7ff77f64c058 call 7ff77f6454a4 call 7ff77f6454c4 653->655 657 7ff77f64c437-7ff77f64c443 call 7ff77f6454a4 call 7ff77f6454c4 654->657 658 7ff77f64c067-7ff77f64c06e 654->658 669 7ff77f64c44e 655->669 677 7ff77f64c449 call 7ff77f64aea4 657->677 658->657 660 7ff77f64c074-7ff77f64c0a2 658->660 660->657 663 7ff77f64c0a8-7ff77f64c0af 660->663 666 7ff77f64c0c8-7ff77f64c0cb 663->666 667 7ff77f64c0b1-7ff77f64c0c3 call 7ff77f6454a4 call 7ff77f6454c4 663->667 672 7ff77f64c433-7ff77f64c435 666->672 673 7ff77f64c0d1-7ff77f64c0d7 666->673 667->677 675 7ff77f64c451-7ff77f64c468 669->675 672->675 673->672 674 7ff77f64c0dd-7ff77f64c0e0 673->674 674->667 678 7ff77f64c0e2-7ff77f64c107 674->678 677->669 681 7ff77f64c109-7ff77f64c10b 678->681 682 7ff77f64c13a-7ff77f64c141 678->682 684 7ff77f64c10d-7ff77f64c114 681->684 685 7ff77f64c132-7ff77f64c138 681->685 686 7ff77f64c143-7ff77f64c16b call 7ff77f64dbbc call 7ff77f64af0c * 2 682->686 687 7ff77f64c116-7ff77f64c12d call 7ff77f6454a4 call 7ff77f6454c4 call 7ff77f64aea4 682->687 684->685 684->687 689 7ff77f64c1b8-7ff77f64c1cf 685->689 714 7ff77f64c16d-7ff77f64c183 call 7ff77f6454c4 call 7ff77f6454a4 686->714 715 7ff77f64c188-7ff77f64c1b3 call 7ff77f64c844 686->715 718 7ff77f64c2c0 687->718 692 7ff77f64c24a-7ff77f64c254 call 7ff77f653f8c 689->692 693 7ff77f64c1d1-7ff77f64c1d9 689->693 706 7ff77f64c2de 692->706 707 7ff77f64c25a-7ff77f64c26f 692->707 693->692 698 7ff77f64c1db-7ff77f64c1dd 693->698 698->692 702 7ff77f64c1df-7ff77f64c1f5 698->702 702->692 703 7ff77f64c1f7-7ff77f64c203 702->703 703->692 708 7ff77f64c205-7ff77f64c207 703->708 710 7ff77f64c2e3-7ff77f64c303 ReadFile 706->710 707->706 712 7ff77f64c271-7ff77f64c283 GetConsoleMode 707->712 708->692 713 7ff77f64c209-7ff77f64c221 708->713 716 7ff77f64c3fd-7ff77f64c406 GetLastError 710->716 717 7ff77f64c309-7ff77f64c311 710->717 712->706 719 7ff77f64c285-7ff77f64c28d 712->719 713->692 721 7ff77f64c223-7ff77f64c22f 713->721 714->718 715->689 726 7ff77f64c408-7ff77f64c41e call 7ff77f6454c4 call 7ff77f6454a4 716->726 727 7ff77f64c423-7ff77f64c426 716->727 717->716 723 7ff77f64c317 717->723 720 7ff77f64c2c3-7ff77f64c2cd call 7ff77f64af0c 718->720 719->710 725 7ff77f64c28f-7ff77f64c2b1 ReadConsoleW 719->725 720->675 721->692 730 7ff77f64c231-7ff77f64c233 721->730 734 7ff77f64c31e-7ff77f64c333 723->734 736 7ff77f64c2b3 GetLastError 725->736 737 7ff77f64c2d2-7ff77f64c2dc 725->737 726->718 731 7ff77f64c42c-7ff77f64c42e 727->731 732 7ff77f64c2b9-7ff77f64c2bb call 7ff77f645438 727->732 730->692 740 7ff77f64c235-7ff77f64c245 730->740 731->720 732->718 734->720 742 7ff77f64c335-7ff77f64c340 734->742 736->732 737->734 740->692 746 7ff77f64c367-7ff77f64c36f 742->746 747 7ff77f64c342-7ff77f64c35b call 7ff77f64bc34 742->747 750 7ff77f64c3eb-7ff77f64c3f8 call 7ff77f64ba74 746->750 751 7ff77f64c371-7ff77f64c383 746->751 755 7ff77f64c360-7ff77f64c362 747->755 750->755 752 7ff77f64c3de-7ff77f64c3e6 751->752 753 7ff77f64c385 751->753 752->720 756 7ff77f64c38a-7ff77f64c391 753->756 755->720 758 7ff77f64c3cd-7ff77f64c3d8 756->758 759 7ff77f64c393-7ff77f64c397 756->759 758->752 760 7ff77f64c399-7ff77f64c3a0 759->760 761 7ff77f64c3b3 759->761 760->761 762 7ff77f64c3a2-7ff77f64c3a6 760->762 763 7ff77f64c3b9-7ff77f64c3c9 761->763 762->761 764 7ff77f64c3a8-7ff77f64c3b1 762->764 763->756 765 7ff77f64c3cb 763->765 764->763 765->752
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
                                                                            • Instruction ID: 4c8b9f854a6ff89f2f47dc4045139cfe09a2aa735efd6466fa924ff766fe5938
                                                                            • Opcode Fuzzy Hash: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
                                                                            • Instruction Fuzzy Hash: 73C1D123A3C7C691E661BB5496002FFB75AEB80B80FD50131DA4D87796CF7CEA4587A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64D520 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 876 7ff77f64d520-7ff77f64d545 877 7ff77f64d54b-7ff77f64d54e 876->877 878 7ff77f64d813 876->878 879 7ff77f64d587-7ff77f64d5b3 877->879 880 7ff77f64d550-7ff77f64d582 call 7ff77f64add8 877->880 881 7ff77f64d815-7ff77f64d825 878->881 883 7ff77f64d5be-7ff77f64d5c4 879->883 884 7ff77f64d5b5-7ff77f64d5bc 879->884 880->881 886 7ff77f64d5d4-7ff77f64d5e9 call 7ff77f653f8c 883->886 887 7ff77f64d5c6-7ff77f64d5cf call 7ff77f64c8e0 883->887 884->880 884->883 891 7ff77f64d703-7ff77f64d70c 886->891 892 7ff77f64d5ef-7ff77f64d5f8 886->892 887->886 893 7ff77f64d70e-7ff77f64d714 891->893 894 7ff77f64d760-7ff77f64d785 WriteFile 891->894 892->891 895 7ff77f64d5fe-7ff77f64d602 892->895 898 7ff77f64d74c-7ff77f64d75e call 7ff77f64cfd8 893->898 899 7ff77f64d716-7ff77f64d719 893->899 896 7ff77f64d787-7ff77f64d78d GetLastError 894->896 897 7ff77f64d790 894->897 900 7ff77f64d613-7ff77f64d61e 895->900 901 7ff77f64d604-7ff77f64d60c call 7ff77f644900 895->901 896->897 905 7ff77f64d793 897->905 920 7ff77f64d6f0-7ff77f64d6f7 898->920 906 7ff77f64d71b-7ff77f64d71e 899->906 907 7ff77f64d738-7ff77f64d74a call 7ff77f64d1f8 899->907 902 7ff77f64d62f-7ff77f64d644 GetConsoleMode 900->902 903 7ff77f64d620-7ff77f64d629 900->903 901->900 910 7ff77f64d6fc 902->910 911 7ff77f64d64a-7ff77f64d650 902->911 903->891 903->902 913 7ff77f64d798 905->913 914 7ff77f64d7a4-7ff77f64d7ae 906->914 915 7ff77f64d724-7ff77f64d736 call 7ff77f64d0dc 906->915 907->920 910->891 918 7ff77f64d6d9-7ff77f64d6eb call 7ff77f64cb60 911->918 919 7ff77f64d656-7ff77f64d659 911->919 921 7ff77f64d79d 913->921 922 7ff77f64d80c-7ff77f64d811 914->922 923 7ff77f64d7b0-7ff77f64d7b5 914->923 915->920 918->920 926 7ff77f64d65b-7ff77f64d65e 919->926 927 7ff77f64d664-7ff77f64d672 919->927 920->913 921->914 922->881 928 7ff77f64d7b7-7ff77f64d7ba 923->928 929 7ff77f64d7e3-7ff77f64d7ed 923->929 926->921 926->927 933 7ff77f64d674 927->933 934 7ff77f64d6d0-7ff77f64d6d4 927->934 935 7ff77f64d7bc-7ff77f64d7cb 928->935 936 7ff77f64d7d3-7ff77f64d7de call 7ff77f645480 928->936 931 7ff77f64d7f4-7ff77f64d803 929->931 932 7ff77f64d7ef-7ff77f64d7f2 929->932 931->922 932->878 932->931 938 7ff77f64d678-7ff77f64d68f call 7ff77f654058 933->938 934->905 935->936 936->929 942 7ff77f64d6c7-7ff77f64d6cd GetLastError 938->942 943 7ff77f64d691-7ff77f64d69d 938->943 942->934 944 7ff77f64d6bc-7ff77f64d6c3 943->944 945 7ff77f64d69f-7ff77f64d6b1 call 7ff77f654058 943->945 944->934 946 7ff77f64d6c5 944->946 945->942 949 7ff77f64d6b3-7ff77f64d6ba 945->949 946->938 949->944
                                                                            APIs
                                                                            • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF77F64D50B), ref: 00007FF77F64D63C
                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF77F64D50B), ref: 00007FF77F64D6C7
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ConsoleErrorLastMode
                                                                            • String ID:
                                                                            • API String ID: 953036326-0
                                                                            • Opcode ID: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
                                                                            • Instruction ID: 169baab0aca9c50c571bb3a9f971cb5ee8ab328fcbd8506bd2d642dd1e371ce2
                                                                            • Opcode Fuzzy Hash: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
                                                                            • Instruction Fuzzy Hash: 1691D433F3869185F790BF2595402FEABAAAB44B88F944139DF0E97685CF38D541C7A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64FCEC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _get_daylight$_isindst
                                                                            • String ID:
                                                                            • API String ID: 4170891091-0
                                                                            • Opcode ID: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
                                                                            • Instruction ID: 5bf1d2cd4b8ccf52d2c331734c96482a713850753e2559393119de476461f02f
                                                                            • Opcode Fuzzy Hash: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
                                                                            • Instruction Fuzzy Hash: 18514873F341928AEB14FF249A456FEA7AA7B80359F900235DD2D93AD5DF38A501C390
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F645854 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                            • String ID:
                                                                            • API String ID: 2780335769-0
                                                                            • Opcode ID: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
                                                                            • Instruction ID: 1d27629b30720927b8aceaa475941015ba65ca8a0426e75d988a142ef6e7f686
                                                                            • Opcode Fuzzy Hash: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
                                                                            • Instruction Fuzzy Hash: 4A517023A386818AF710FF60D6503FEA3A6AB44758F504535DE4DD768DDF38D94487A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63C07C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                            • String ID:
                                                                            • API String ID: 1452418845-0
                                                                            • Opcode ID: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
                                                                            • Instruction ID: 9197b25e6ca0fc772f81403306c3a5d390f773161aa3674c42b4ada05a7b1b39
                                                                            • Opcode Fuzzy Hash: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
                                                                            • Instruction Fuzzy Hash: 71310923A385C381FA24BB6496513FBA2DB9F41744FC45035E90EC72D7DE2DA50492B1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F645700 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 1279662727-0
                                                                            • Opcode ID: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
                                                                            • Instruction ID: ab93cc1830fea741a5beb9d20f9c8055a6b690b7d288270829c2555ee7b61ace
                                                                            • Opcode Fuzzy Hash: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
                                                                            • Instruction Fuzzy Hash: 9541A623D387C183E750BB2096103BAA365FF94764F509334EA5C47AD5DF6CAAE48790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64027C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
                                                                            • Instruction ID: 5acbeeae96fe96db3576407126ae54b5a011f80c02dacb0c97ff53d0d8d2eb10
                                                                            • Opcode Fuzzy Hash: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
                                                                            • Instruction Fuzzy Hash: 06512923B396E296E624BE3597006FBA58BBF40BA4F444634DD6C877C5CE3CD60087A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63BF90 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Initialize_invalid_parameter_noinfo_set_fmode
                                                                            • String ID:
                                                                            • API String ID: 3548387204-0
                                                                            • Opcode ID: 8fe16d89185869baf5eab60e438c3c72e8fc46f5e9ebbf224ebf2c9926b5ce16
                                                                            • Instruction ID: 341076eb46a99bf7ade34cb1b00438301b39f20957c13a6e41e5e1957fe640df
                                                                            • Opcode Fuzzy Hash: 8fe16d89185869baf5eab60e438c3c72e8fc46f5e9ebbf224ebf2c9926b5ce16
                                                                            • Instruction Fuzzy Hash: BF115212E382C281FA057BB44B566FB929B0F91354FC10434F94EC62D3EE2EB9544AF2
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64B11C Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF77F64AF99,?,?,00000000,00007FF77F64B04E), ref: 00007FF77F64B18A
                                                                            • GetLastError.KERNEL32(?,?,?,00007FF77F64AF99,?,?,00000000,00007FF77F64B04E), ref: 00007FF77F64B194
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ChangeCloseErrorFindLastNotification
                                                                            • String ID:
                                                                            • API String ID: 1687624791-0
                                                                            • Opcode ID: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
                                                                            • Instruction ID: cc63a605a122413bc1a58973d5ad4580c29c817cb16534ebb42ec731573cb4e5
                                                                            • Opcode Fuzzy Hash: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
                                                                            • Instruction Fuzzy Hash: 5221D723B386C241FF9077B8D6542FB928B6F44B98F845234DA1DC77C1CE2CA54587A1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64C6F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorFileLastPointer
                                                                            • String ID:
                                                                            • API String ID: 2976181284-0
                                                                            • Opcode ID: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
                                                                            • Instruction ID: 532c44ac326c015a243f4e70d9d1b90735eaa18f201b731156491ef717adbe0d
                                                                            • Opcode Fuzzy Hash: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
                                                                            • Instruction Fuzzy Hash: 57110427738BC182DA10BB25A5000BAA766AB44BF4F940331EEBD877D9CF3CD1418790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6459FC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77F645911), ref: 00007FF77F645A2F
                                                                            • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77F645911), ref: 00007FF77F645A45
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Time$System$FileLocalSpecific
                                                                            • String ID:
                                                                            • API String ID: 1707611234-0
                                                                            • Opcode ID: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
                                                                            • Instruction ID: dd39140f935fc6678814fd53ea2d4e45381cbdf100e3cf12fd9306139ad0850b
                                                                            • Opcode Fuzzy Hash: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
                                                                            • Instruction Fuzzy Hash: 9A11B22363C68281EA50BB05A5410BFF366FF84760F900235FA9DC59D8DF2CD544CB60
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64AF0C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF77F653392,?,?,?,00007FF77F6533CF,?,?,00000000,00007FF77F653895,?,?,00000000,00007FF77F6537C7), ref: 00007FF77F64AF22
                                                                            • GetLastError.KERNEL32(?,?,?,00007FF77F653392,?,?,?,00007FF77F6533CF,?,?,00000000,00007FF77F653895,?,?,00000000,00007FF77F6537C7), ref: 00007FF77F64AF2C
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                            • String ID:
                                                                            • API String ID: 588628887-0
                                                                            • Opcode ID: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
                                                                            • Instruction ID: 0ede96acc91535c435e41857a70a3ced4deacc42635ebf857a612d94d4db5f6c
                                                                            • Opcode Fuzzy Hash: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
                                                                            • Instruction Fuzzy Hash: A2E04F92F3868242FB557BB55A450B7915B5F94701BC04474CD0EDB292DE2CA98942B0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64C46C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: 491d756dfbf5d606f7e783a7bab36e7eaa3001c20d525fc7b9da7dd63869e3d6
                                                                            • Instruction ID: 0270cf73c421cc5d21c502c29ec36e795b5cdbc26531e72150d346733ff53109
                                                                            • Opcode Fuzzy Hash: 491d756dfbf5d606f7e783a7bab36e7eaa3001c20d525fc7b9da7dd63869e3d6
                                                                            • Instruction Fuzzy Hash: 6741B57393828187EA24FB29A7401BEB7AAEB55745F900131D69DC3791CF2CE642C7B1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6382B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _fread_nolock
                                                                            • String ID:
                                                                            • API String ID: 840049012-0
                                                                            • Opcode ID: 4e44655d6e3f8f50a8c8fdfc581bd4bdee33df20cb66f4ccb7101741f0dc65c8
                                                                            • Instruction ID: 2013304a1e9e686addc397b204acbf755523b3332e75b180d6f66aa60e33bc66
                                                                            • Opcode Fuzzy Hash: 4e44655d6e3f8f50a8c8fdfc581bd4bdee33df20cb66f4ccb7101741f0dc65c8
                                                                            • Instruction Fuzzy Hash: 97217F23B386A145FA51BA6266047FBE65ABF45FD4FCC5030EE0986786CE3CE1018290
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64BEFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
                                                                            • Instruction ID: 17e42f2aea1204fdc3e93f3eab5420877e2a232dbb9cf2d03d1e1d6693357869
                                                                            • Opcode Fuzzy Hash: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
                                                                            • Instruction Fuzzy Hash: FE31A623A3868185F781BB55CA413FEA65AAF40B61F810135DD1D877D2CF7CEA4287B1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6464A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
                                                                            • Instruction ID: b78cb489960f5134897b5d50fcf16d221ec21145f6e3689a458733201427a320
                                                                            • Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
                                                                            • Instruction Fuzzy Hash: 18118763A3C6C1C1EE61BF5196011FBE26ABF85B84F844431EA4CC7A86DF7DD64087A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F656CAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
                                                                            • Instruction ID: 2ab124340198b0ed2bc3d325fac4cddf3bb940a5f01fdb11adea5c91939a622d
                                                                            • Opcode Fuzzy Hash: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
                                                                            • Instruction Fuzzy Hash: 5421A473638A8186DB61AF18D6403BAB2A5EB84B54F544234DA5D876D9DF3DD400CB50
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6404FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
                                                                            • Instruction ID: de5f38c20a221d7a7d57608d768b36ed449eb03f0634c81c00283df7ba84af21
                                                                            • Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
                                                                            • Instruction Fuzzy Hash: 53018622A3479140EA04BB5657001BAE69AFF85FE0F884630DE6C97BDADE3CD6114350
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64827C Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: 94f8dedca99e8e5f97d7803b63f363a8ae8936c7a006dfc60ce4e9976b5f5c5f
                                                                            • Instruction ID: 288ae4e22091a7c883042f442f60b86f0abfec956044c4c52c6ecb08a65a7016
                                                                            • Opcode Fuzzy Hash: 94f8dedca99e8e5f97d7803b63f363a8ae8936c7a006dfc60ce4e9976b5f5c5f
                                                                            • Instruction Fuzzy Hash: 4B115E33938AC292E600BB64AA400BBE6AAFF40B40F950135D65DD7696DF3CF91187E0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F647AB0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: af50f55acc611b54009b4ea4d598cf3424078558251c62237d26469a9987366e
                                                                            • Instruction ID: 2d87e8a231fd865b229990ffc3c04b2fdbae4134ad846e7fe13f6816ff0b271e
                                                                            • Opcode Fuzzy Hash: af50f55acc611b54009b4ea4d598cf3424078558251c62237d26469a9987366e
                                                                            • Instruction Fuzzy Hash: 71015E22E3D6C240FE907A616B451F7D19FAF41790F940534E92DC2AC6DF2CA68146F0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64F158 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF77F64B9A6,?,?,?,00007FF77F64AB67,?,?,00000000,00007FF77F64AE02), ref: 00007FF77F64F1AD
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: AllocateHeap
                                                                            • String ID:
                                                                            • API String ID: 1279760036-0
                                                                            • Opcode ID: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
                                                                            • Instruction ID: c518f06a3690e3e8f0f4597c2f7c0545bca55dd9eefaf26041184d79db8cc858
                                                                            • Opcode Fuzzy Hash: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
                                                                            • Instruction Fuzzy Hash: C1F03766B3928681FE5576619A112FB829B5F88B40F884431CD1ECB3C2EF1CA68086B0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64DBBC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RtlAllocateHeap.NTDLL(?,?,?,00007FF77F640D24,?,?,?,00007FF77F642236,?,?,?,?,?,00007FF77F643829), ref: 00007FF77F64DBFA
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: AllocateHeap
                                                                            • String ID:
                                                                            • API String ID: 1279760036-0
                                                                            • Opcode ID: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
                                                                            • Instruction ID: 04397e5893486e116d9868ff03a4990cffd423e3c33a8dc95baa4930b9b358db
                                                                            • Opcode Fuzzy Hash: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
                                                                            • Instruction Fuzzy Hash: CAF05482F3C2C641FE95B6A15B012F7916E5F457A0F884630DE2EC66C1DD5CA54181B0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F647DEC Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: f6d2080b1b78402d7abe66b145058d3ba054e314cadcac67310d584db64078aa
                                                                            • Instruction ID: 8c06c24b8c30bf017b3a439550a7c72608467e4c7580ddc71d859ae90eaae01f
                                                                            • Opcode Fuzzy Hash: f6d2080b1b78402d7abe66b145058d3ba054e314cadcac67310d584db64078aa
                                                                            • Instruction Fuzzy Hash: 71E08C66E383C242FA11BBA10B821FB911AAF44301F800830DA08CA2C7DE1CAE5852B1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Non-executed Functions

                                                                            Function 00007FF77F636EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: AddressProc
                                                                            • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                            • API String ID: 190572456-2208601799
                                                                            • Opcode ID: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
                                                                            • Instruction ID: 86505851d4d93f0b0985e12e3a82526280d7b5261ae877eef865ea0104c36d86
                                                                            • Opcode Fuzzy Hash: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
                                                                            • Instruction Fuzzy Hash: AAE1F667A3DBC391FA14BB08AA401F6E3AFAF15744BC41034D91D972A4EF7DB14882B5
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F631F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                            • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                            • API String ID: 2446303242-1601438679
                                                                            • Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
                                                                            • Instruction ID: 456b27feec9ffa73c0d5f8ebee3cae53866f3f66741a6f046e6c4ffaabc93edc
                                                                            • Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
                                                                            • Instruction Fuzzy Hash: 85A18937328BC586E3149F15E5447AAB365FB88B84F904129EB9D53B28CF3DE164CB90
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F65471C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                            • API String ID: 808467561-2761157908
                                                                            • Opcode ID: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
                                                                            • Instruction ID: 7f4f57c0b5cbbe9aa287a60d54f7d05fbee83586b733a34041d24d884eaeca87
                                                                            • Opcode Fuzzy Hash: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
                                                                            • Instruction Fuzzy Hash: 3DB2EC73B382D24BE7649E64D6547FEB7A6FB44348F901135D60DA7A88DB38E900CB90
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F638560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLastError.KERNEL32(00000000,00007FF77F632A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F638587
                                                                            • FormatMessageW.KERNEL32 ref: 00007FF77F6385B6
                                                                            • WideCharToMultiByte.KERNEL32 ref: 00007FF77F63860C
                                                                              • Part of subcall function 00007FF77F6329E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77F6387F2,?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F632A14
                                                                              • Part of subcall function 00007FF77F6329E0: MessageBoxW.USER32 ref: 00007FF77F632AF0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                            • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                            • API String ID: 2920928814-2573406579
                                                                            • Opcode ID: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
                                                                            • Instruction ID: 4b0fd2508904eb4977f9b3b5df1d0a9d488bcd15d9bc4a696d4242d345a2d8d5
                                                                            • Opcode Fuzzy Hash: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
                                                                            • Instruction Fuzzy Hash: 7C218173B3CA8281E660AB15E9402F7A26ABF48788FC40135D64DD36A4DF7CD54587A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63C57C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                            • String ID:
                                                                            • API String ID: 3140674995-0
                                                                            • Opcode ID: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
                                                                            • Instruction ID: 56f3815bea59c760c1e87ee3e4914732d5bf69000749f4fa5abce6efd9df7a8e
                                                                            • Opcode Fuzzy Hash: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
                                                                            • Instruction Fuzzy Hash: C6316273724AC186EB609F64E9403FEB365FB84748F844039DA4D97A94DF38D248C720
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64ABD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                            • String ID:
                                                                            • API String ID: 1239891234-0
                                                                            • Opcode ID: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
                                                                            • Instruction ID: 9c94559794cc95a1d7e70b743410acc8879c8a65d338eb4969967c5a3b4fc8b4
                                                                            • Opcode Fuzzy Hash: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
                                                                            • Instruction Fuzzy Hash: C7315033628B8186DB60EF25E9402FEB3A5FB85758F900135EA8D83B54DF38D6558B50
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F651EE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 2227656907-0
                                                                            • Opcode ID: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
                                                                            • Instruction ID: 5bee1553f8aac5e8fa407f533505279fe6fe53e087c7d769048263e81e4b5e29
                                                                            • Opcode Fuzzy Hash: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
                                                                            • Instruction Fuzzy Hash: F3B19267B396D241EA60BB219A001FBA39BAB44BA4F844131EA5DD7AC5DF3CE541C390
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63C460 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                            • String ID:
                                                                            • API String ID: 2933794660-0
                                                                            • Opcode ID: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
                                                                            • Instruction ID: c7d1ed258975fe03f79ffe5c44f94e3cc9295cb597aa35476e27a0344a8ebcde
                                                                            • Opcode Fuzzy Hash: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
                                                                            • Instruction Fuzzy Hash: E4115126B24F4589EB00DFA4E9542FA73A8FB18758F440E31DA6D877A4DF78D16483A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F654280 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memcpy_s
                                                                            • String ID:
                                                                            • API String ID: 1502251526-0
                                                                            • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                            • Instruction ID: 60c8dc5bb92fa91cc810b164dd55ea367d4de48bb9487381f9af035b60951b2a
                                                                            • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                            • Instruction Fuzzy Hash: 2BC10373B3D6C687DB249F19A2546AAB796F784784F948134DB4E93744DB3DE800CB80
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F659FF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ExceptionRaise_clrfp
                                                                            • String ID:
                                                                            • API String ID: 15204871-0
                                                                            • Opcode ID: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
                                                                            • Instruction ID: 73da516a5b4ea95034a29c87e118e1e166a71cddbb03e380907c3a8b2f82f8b1
                                                                            • Opcode Fuzzy Hash: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
                                                                            • Instruction Fuzzy Hash: 27B1BE73620B898BEB15CF29C9863AD7BE1F784B48F588821DB5D837A4CB3AD451C750
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6388D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Find$CloseFileFirst
                                                                            • String ID:
                                                                            • API String ID: 2295610775-0
                                                                            • Opcode ID: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
                                                                            • Instruction ID: 77e5a52db70f367136fecc8bac7169dc3e1346d06c4f53334e9799db4e4313fb
                                                                            • Opcode Fuzzy Hash: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
                                                                            • Instruction Fuzzy Hash: 82F08123A386C586E7B09F68A5487EBB3A5BF44728F800335D6AD426D4DF3CD0088A50
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F643AE4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: $
                                                                            • API String ID: 0-227171996
                                                                            • Opcode ID: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
                                                                            • Instruction ID: f69d251d03ccd1925857280eebff7ad83fdfe72ace96aa5124122302d35e0a6e
                                                                            • Opcode Fuzzy Hash: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
                                                                            • Instruction Fuzzy Hash: 81E1FB3393868181E768FE1582421BEB36AFF45BC8F945235CA4E83794CF29DA41F790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64E4B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: e+000$gfff
                                                                            • API String ID: 0-3030954782
                                                                            • Opcode ID: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
                                                                            • Instruction ID: 5ab3c2555f8c43c9238900e9b61f8026d29ef5f717f34b57f0455e9e790b0929
                                                                            • Opcode Fuzzy Hash: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
                                                                            • Instruction Fuzzy Hash: 83518C27F382C146E724BF359A107BAEB96E754B94F888231CBA887AC5DE3DD1008751
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64E01C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: gfffffff
                                                                            • API String ID: 0-1523873471
                                                                            • Opcode ID: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
                                                                            • Instruction ID: 248ce71069df95937d253aa7bfe0f927d63d07ac258e1222c69b17416bcd83a5
                                                                            • Opcode Fuzzy Hash: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
                                                                            • Instruction Fuzzy Hash: A9A15A67A287C586EB21FB2595007FFBB96AB60784F448031DE4D87781DE3DD601C752
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6486D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID: TMP
                                                                            • API String ID: 3215553584-3125297090
                                                                            • Opcode ID: 62b6c69223ad9ff32341f9fc481f2db1a4e08787c02cb3fa9a4a634f1d01240c
                                                                            • Instruction ID: 9d35ac352ae7d36f329940357b62ca7cfec3ca592d2105a795b407eb59411256
                                                                            • Opcode Fuzzy Hash: 62b6c69223ad9ff32341f9fc481f2db1a4e08787c02cb3fa9a4a634f1d01240c
                                                                            • Instruction Fuzzy Hash: 27517116F3868241EA54BA365B111FBD29BBF45FC4B884034DD0DD77D6EE3CE54142A4
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F653AF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: HeapProcess
                                                                            • String ID:
                                                                            • API String ID: 54951025-0
                                                                            • Opcode ID: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
                                                                            • Instruction ID: ae9594c0f09dc14b73931dd537107842e1a3be780ffbb3aabfc427c37bb95179
                                                                            • Opcode Fuzzy Hash: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
                                                                            • Instruction Fuzzy Hash: 35B09221F3BA86C2EB983B256D8625562AA7F48B10FD44039C10C92320DE2C20B54760
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6436E0 Relevance: .3, Instructions: 327COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
                                                                            • Instruction ID: dbfd3fde6d67b0fa774355469797af7edb37278f22030bbac9a1ea69477fc9f3
                                                                            • Opcode Fuzzy Hash: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
                                                                            • Instruction Fuzzy Hash: 9FD1FC6393868285E728BE2582012BFA76AEF05B88F944135CE0D876D5DF3DD645F3A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F638FD0 Relevance: .3, Instructions: 287COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
                                                                            • Instruction ID: 23f92a06f55d139a5f3583554090470dd0aff13f518ee30ee25dde8bfa759561
                                                                            • Opcode Fuzzy Hash: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
                                                                            • Instruction Fuzzy Hash: 8CC116332241F04BD698FB29E4594BA73E6F7A9309BD5403AEB8747785C63CE414DB60
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F642D50 Relevance: .2, Instructions: 241COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
                                                                            • Instruction ID: 78b7bf6c5c9f4f40e12c310fcecaa1f894c6bdf36601d3c0f976020a04083a75
                                                                            • Opcode Fuzzy Hash: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
                                                                            • Instruction Fuzzy Hash: 45B1BF7353868585E764BF29C2502BEBBAAF705F48FA40235CA4D83395CF39D641E7A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64EB30 Relevance: .2, Instructions: 198COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
                                                                            • Instruction ID: e1c8c313dc18b9ea4c4419bbac0d5ec1645659c8818e22115eab78cdb85b3abe
                                                                            • Opcode Fuzzy Hash: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
                                                                            • Instruction Fuzzy Hash: B3811677A386C146E774FB1996803BBE696FB65790F804235DA9D83B85CE3CD2008B51
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F656D70 Relevance: .2, Instructions: 183COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID:
                                                                            • API String ID: 3215553584-0
                                                                            • Opcode ID: 3a6143a7b5f00f0189e4837f13cf3fad345f6e9eb837262b3e4ffc84bd4cc460
                                                                            • Instruction ID: 2f59718a656b4549cc2be879a0b8cb0c55e34616a9c91ab39f456047b7331543
                                                                            • Opcode Fuzzy Hash: 3a6143a7b5f00f0189e4837f13cf3fad345f6e9eb837262b3e4ffc84bd4cc460
                                                                            • Instruction Fuzzy Hash: 9361D723F3C2D2C6F764B92886502BBE69BAF40364F940235D61DD76D5DE6FE801C6A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F641E94 Relevance: .1, Instructions: 146COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
                                                                            • Instruction ID: c1e1217ea7d7f9010f714fff9cc72b5ca1717c32c53e86cf55ddb1fc91e5d831
                                                                            • Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
                                                                            • Instruction Fuzzy Hash: CF51A477A3469182E765BB28C1402BAA7A6EB44F68F744131CE4C877D4CB3AE943C790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F641A84 Relevance: .1, Instructions: 146COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
                                                                            • Instruction ID: 62ac793463483ed1c5b95e35491c9128e57ba48c2249851a9adf0354e5b34ce0
                                                                            • Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
                                                                            • Instruction Fuzzy Hash: 7251D9B3A3869181E725BF18C1402BA7766EB45B78F745131CE4C87794DB3AE942C7D0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6422A4 Relevance: .1, Instructions: 146COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
                                                                            • Instruction ID: 590c789c6d3af0338e9d1e044d9a2fb8fa07f279a2fbfab91d4236b31df58acb
                                                                            • Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
                                                                            • Instruction Fuzzy Hash: E451A473A3869181E725BB29C1402BAB3B7EB55B58F744131CA4C87794CF3AE942C7D0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F641880 Relevance: .1, Instructions: 145COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
                                                                            • Instruction ID: ac9f983b38256785b123fbbb8bb73ea3b2e3eee48633700de8215ab84be0fa64
                                                                            • Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
                                                                            • Instruction Fuzzy Hash: DC51FA73B386D185E725BB29C14027EA7A6EB44B68F744131CE4C87795CB3AEA43C790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6420A0 Relevance: .1, Instructions: 145COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
                                                                            • Instruction ID: 42926c9a360e875f56e28088372e042428ff9728a772e66b4817d25ec24ef425
                                                                            • Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
                                                                            • Instruction Fuzzy Hash: BD51B83363469181E724BB28C14027A67A7EB55B58F744131CF4C97794CF3AEA42CB90
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F641C90 Relevance: .1, Instructions: 145COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
                                                                            • Instruction ID: 3e386a6623d98e05678023bdd8f5d72bfbb5f67e5a60cc81940cc27fbea77d66
                                                                            • Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
                                                                            • Instruction Fuzzy Hash: 8F51B8B7B3469181E725BB29C1403B977A6EB45B68F744131CE4C87794CB3AE943C790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F645F30 Relevance: .1, Instructions: 138COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                            • Instruction ID: 080fb09a6cc0b3c5e95f89f697b6bdc785c21e32f6d2e16e7dfc495bc2736d6b
                                                                            • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                            • Instruction Fuzzy Hash: CB411C8383D7CA80E995791807046F6D68BAF22FA0DD452B4CD9D973CBCD0E2B86C162
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64A430 Relevance: .1, Instructions: 126COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                            • String ID:
                                                                            • API String ID: 588628887-0
                                                                            • Opcode ID: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
                                                                            • Instruction ID: 4abda7b248a0aba895195b390b9c65e28ef1bdff410200d53c592552c13a1c4c
                                                                            • Opcode Fuzzy Hash: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
                                                                            • Instruction Fuzzy Hash: BB41F773734A9441FF18EF6ADA141BAA3A6A748FD4B849036DE0DC7B58DE3DD1428350
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F647C98 Relevance: .1, Instructions: 98COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 07f4a39e9cc2ad1441a8aa1ffea777e60b39e7c177a4820a8f2f9fbe0e0676c5
                                                                            • Instruction ID: ffd80fc12e865a9540d868011960d05a43ab86a4f6d23d83d0267c6856e74b4d
                                                                            • Opcode Fuzzy Hash: 07f4a39e9cc2ad1441a8aa1ffea777e60b39e7c177a4820a8f2f9fbe0e0676c5
                                                                            • Instruction Fuzzy Hash: D731B633739B8241E764FF2565401BEA69AAB84B90F444338EA4D93BD6DF3CD5024754
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F659E40 Relevance: .0, Instructions: 32COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
                                                                            • Instruction ID: a75b354cff4c41728612cdd1f8a701ff7adff56d299c309b74eeb6e8cc7f4bbf
                                                                            • Opcode Fuzzy Hash: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
                                                                            • Instruction Fuzzy Hash: A6F0C8B27382918ADB949F28A90266A77D6F7083D0FC0C07AD58CC3F04D63C80508F64
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63C760 Relevance: .0, Instructions: 2COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
                                                                            • Instruction ID: 3df28210565a46c2f48e337f93a6b01106a9619590afade2d2f1f64932d6029e
                                                                            • Opcode Fuzzy Hash: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
                                                                            • Instruction Fuzzy Hash: F2A00223A3CC87D0EA94AB14EA500F6A77AFF51304BD00031E40DD24A09F3CF541D3A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6351E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: AddressProc
                                                                            • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                            • API String ID: 190572456-4266016200
                                                                            • Opcode ID: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
                                                                            • Instruction ID: 1adbafbb6c30b77ed397a9909018eba41c9d336fcd1c262627fb9295e4e9b51a
                                                                            • Opcode Fuzzy Hash: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
                                                                            • Instruction Fuzzy Hash: BA12CA66A3AB8390FA15EB19AE500F6A6BBAF14744BC41431C81ED7254FF7CB548C2F4
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6312B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Message_fread_nolock
                                                                            • String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
                                                                            • API String ID: 3065259568-2316137593
                                                                            • Opcode ID: 09b725888f1134dd8a7eb2b51234559cca5a545f20e53f48389aefb22977cf34
                                                                            • Instruction ID: c2cffbe3c72c4d3b058a1c4cf12df972bf55ef63a699ef620089a94b2b5b7d3f
                                                                            • Opcode Fuzzy Hash: 09b725888f1134dd8a7eb2b51234559cca5a545f20e53f48389aefb22977cf34
                                                                            • Instruction Fuzzy Hash: 7151A163F386C746EA20B715AA512FBA39AAF44794FC04031EE4DC7786EE3CE5458790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6323F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                            • String ID: P%
                                                                            • API String ID: 2147705588-2959514604
                                                                            • Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
                                                                            • Instruction ID: 039270f4e3351c0a2bae9d99e1325f04a49194807f566dfb2d5072c850ddc776
                                                                            • Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
                                                                            • Instruction Fuzzy Hash: EC51F8266247E186D6349F26E0181BBF7A2FB98B61F004121EBCE83795DF3CD045DB20
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6467A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID: -$:$f$p$p
                                                                            • API String ID: 3215553584-2013873522
                                                                            • Opcode ID: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
                                                                            • Instruction ID: a0f477b014bba8f9a198f693f6b466ef3a448f205aaced0cfb9544d91f24074b
                                                                            • Opcode Fuzzy Hash: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
                                                                            • Instruction Fuzzy Hash: 7C1273A3E381C3C6FB14BA14D2542FBE6ABEB40754FC44135D689866C4DF3EE69087A1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F641108 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID: f$f$p$p$f
                                                                            • API String ID: 3215553584-1325933183
                                                                            • Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
                                                                            • Instruction ID: 6ebe13b18f5e504703a61d4405c6f113caad61d3ea6c3dccfaf33b11eab743d1
                                                                            • Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
                                                                            • Instruction Fuzzy Hash: 081296A3E3C1C385FB257A14D2046FBF65BEB40760FE44135D69A866C4DB3DE6808BA4
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6315A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Message
                                                                            • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                            • API String ID: 2030045667-3659356012
                                                                            • Opcode ID: abf57778c6bc2bd746476891fe6417f9746fbbe83606759194bcd4ae104bd2dd
                                                                            • Instruction ID: 223f8471528411f5b545707bc29249c6fa29322901bdd0be1667dffe0e1ca885
                                                                            • Opcode Fuzzy Hash: abf57778c6bc2bd746476891fe6417f9746fbbe83606759194bcd4ae104bd2dd
                                                                            • Instruction Fuzzy Hash: F831E463B385D386EA20BB51AA001FBE39AEF057D4FC85031DE4D97A55EE3CE10597A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63EB00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                            • String ID: csm$csm$csm
                                                                            • API String ID: 849930591-393685449
                                                                            • Opcode ID: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
                                                                            • Instruction ID: 6f1efd9377be31a8aeb3460e53dae0cb663105b48f2f7c2eee2e30ce0802f3c1
                                                                            • Opcode Fuzzy Hash: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
                                                                            • Instruction Fuzzy Hash: 13E1A277A2878185EB20AB24D5402EEB7A9FF55788F400135EE4D97B95CF38E444C7A2
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64F1D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF77F64F56A,?,?,000002AE71B88A48,00007FF77F64B317,?,?,?,00007FF77F64B20E,?,?,?,00007FF77F646452), ref: 00007FF77F64F34C
                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF77F64F56A,?,?,000002AE71B88A48,00007FF77F64B317,?,?,?,00007FF77F64B20E,?,?,?,00007FF77F646452), ref: 00007FF77F64F358
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: AddressFreeLibraryProc
                                                                            • String ID: api-ms-$ext-ms-
                                                                            • API String ID: 3013587201-537541572
                                                                            • Opcode ID: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
                                                                            • Instruction ID: 3394902103436cd51f9d4e8cb85286a3793514db65cc141325a51ec2d774adf8
                                                                            • Opcode Fuzzy Hash: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
                                                                            • Instruction Fuzzy Hash: 07411523B39A8241FA16FB569B001F7A29BBF44B94F880135DD1DDB784DE3CE54983A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6386B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F638747
                                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F63879E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharMultiWide
                                                                            • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                            • API String ID: 626452242-27947307
                                                                            • Opcode ID: 3db36df9c8d9537ffc1a870142728ba31ba65280d977263f07554ad4c995c874
                                                                            • Instruction ID: 50656ba68ca56c5e478d850eb16205ead303bd38310ce1ffde3c4fff4d1fbc64
                                                                            • Opcode Fuzzy Hash: 3db36df9c8d9537ffc1a870142728ba31ba65280d977263f07554ad4c995c874
                                                                            • Instruction Fuzzy Hash: 01418433A2CAC282D660EF15A5401BBE6AAFF84B90F944135DA9D87B94DF3CE045C750
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F638BF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • WideCharToMultiByte.KERNEL32(?,00007FF77F6339EA), ref: 00007FF77F638C31
                                                                              • Part of subcall function 00007FF77F6329E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77F6387F2,?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F632A14
                                                                              • Part of subcall function 00007FF77F6329E0: MessageBoxW.USER32 ref: 00007FF77F632AF0
                                                                            • WideCharToMultiByte.KERNEL32(?,00007FF77F6339EA), ref: 00007FF77F638CA5
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                            • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                            • API String ID: 3723044601-27947307
                                                                            • Opcode ID: 7cfc53ec1e7d7e3796f815228c84741cfee21f3cfb1208b0d82f5073ed857cdd
                                                                            • Instruction ID: f98cb0ff70a103654ec1fc5058f8ff15435ad0fc94ef4fd6cbe6c2baa11b73c6
                                                                            • Opcode Fuzzy Hash: 7cfc53ec1e7d7e3796f815228c84741cfee21f3cfb1208b0d82f5073ed857cdd
                                                                            • Instruction Fuzzy Hash: 01217833B3978285EA10EF26EA410FAF266FF84B80B944235D64D93795DF3CE5418390
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6375A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo$_fread_nolock
                                                                            • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                                                            • API String ID: 3231891352-3501660386
                                                                            • Opcode ID: e98872a19d9130f130bbde9962ddc68dd11f225a0d4d19563b9e793c459c0872
                                                                            • Instruction ID: 4dfb7671752c3f13c857ab111b1ec7558cce0e8fe07d232e1fa7fbc85453fa3f
                                                                            • Opcode Fuzzy Hash: e98872a19d9130f130bbde9962ddc68dd11f225a0d4d19563b9e793c459c0872
                                                                            • Instruction Fuzzy Hash: 9E515D66A3D6D351FA10BB259B502FB92AB9F96B80FC40030ED0DC76D6DE2CE50182E0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63DDB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadLibraryExW.KERNEL32(?,?,?,00007FF77F63E06A,?,?,?,00007FF77F63DD5C,?,?,00000001,00007FF77F63D979), ref: 00007FF77F63DE3D
                                                                            • GetLastError.KERNEL32(?,?,?,00007FF77F63E06A,?,?,?,00007FF77F63DD5C,?,?,00000001,00007FF77F63D979), ref: 00007FF77F63DE4B
                                                                            • LoadLibraryExW.KERNEL32(?,?,?,00007FF77F63E06A,?,?,?,00007FF77F63DD5C,?,?,00000001,00007FF77F63D979), ref: 00007FF77F63DE75
                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF77F63E06A,?,?,?,00007FF77F63DD5C,?,?,00000001,00007FF77F63D979), ref: 00007FF77F63DEBB
                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF77F63E06A,?,?,?,00007FF77F63DD5C,?,?,00000001,00007FF77F63D979), ref: 00007FF77F63DEC7
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                                                            • String ID: api-ms-
                                                                            • API String ID: 2559590344-2084034818
                                                                            • Opcode ID: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
                                                                            • Instruction ID: 065afd3047aaefe9b2a2b81282ba328d8aa259d6a5f9aba0e4640484c08b573d
                                                                            • Opcode Fuzzy Hash: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
                                                                            • Instruction Fuzzy Hash: D731E623B3A68691EE61FB069A005F6A79EBF54BA4F990534DE1D97340DF3CE44483A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F637420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00007FF77F638AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF77F632ABB), ref: 00007FF77F638B1A
                                                                            • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF77F6379A1,00000000,?,00000000,00000000,?,00007FF77F63154F), ref: 00007FF77F63747F
                                                                              • Part of subcall function 00007FF77F632B30: MessageBoxW.USER32 ref: 00007FF77F632C05
                                                                            Strings
                                                                            • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF77F637456
                                                                            • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF77F6374DA
                                                                            • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF77F637493
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                            • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                            • API String ID: 1662231829-3498232454
                                                                            • Opcode ID: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
                                                                            • Instruction ID: a38fff2cebd1d82effbdd40586d90e5f72d5fbc3103a96ccfc98c6bdbdd15249
                                                                            • Opcode Fuzzy Hash: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
                                                                            • Instruction Fuzzy Hash: 06318553F3C6C641FA24B7259A153FBD25BAF99780FC44431DA4EC2796EE2CE10487A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F638AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF77F632ABB), ref: 00007FF77F638B1A
                                                                              • Part of subcall function 00007FF77F6329E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77F6387F2,?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F632A14
                                                                              • Part of subcall function 00007FF77F6329E0: MessageBoxW.USER32 ref: 00007FF77F632AF0
                                                                            • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF77F632ABB), ref: 00007FF77F638BA0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                            • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                            • API String ID: 3723044601-876015163
                                                                            • Opcode ID: a541b9d7990873fa03eea91fa1c4eed32b472e1874b52a165eeb314caebc5777
                                                                            • Instruction ID: 9d11a44ff04213bd6c3d6f4957642b12258f089abb29d6e64c14b874c3827374
                                                                            • Opcode Fuzzy Hash: a541b9d7990873fa03eea91fa1c4eed32b472e1874b52a165eeb314caebc5777
                                                                            • Instruction Fuzzy Hash: 37214623B3C68281EB50EB25F9410AAE366FF857D4B944231DB5CD37A9EE2CD5418750
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64B710 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Value$ErrorLast
                                                                            • String ID:
                                                                            • API String ID: 2506987500-0
                                                                            • Opcode ID: 4c036152db15b5a2576d662e79388d683b1cca67e39eb64d5f9cdec899b2deef
                                                                            • Instruction ID: d37fde8287ed0599854a40162ec75673b62c8bf7ae4c7c471389252d915ed498
                                                                            • Opcode Fuzzy Hash: 4c036152db15b5a2576d662e79388d683b1cca67e39eb64d5f9cdec899b2deef
                                                                            • Instruction Fuzzy Hash: BF21BA2AA3C2C241FA58776997111FBE25B5F447B0F804730D83EC7AE6DE2CA6014BA5
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6585BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                            • String ID: CONOUT$
                                                                            • API String ID: 3230265001-3130406586
                                                                            • Opcode ID: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
                                                                            • Instruction ID: 3b63064363b57a690a199e9d28bae8dfbc91c90be6ee6bf6c1b6cf0625063ed7
                                                                            • Opcode Fuzzy Hash: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
                                                                            • Instruction Fuzzy Hash: DE11D626B38A8186E7509B16EA5437AB7A9FB88FE4F400234D91DC77A4DF3CD4448794
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64B888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLastError.KERNEL32(?,?,?,00007FF77F6454CD,?,?,?,?,00007FF77F64F1BF,?,?,00000000,00007FF77F64B9A6,?,?,?), ref: 00007FF77F64B897
                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF77F6454CD,?,?,?,?,00007FF77F64F1BF,?,?,00000000,00007FF77F64B9A6,?,?,?), ref: 00007FF77F64B8CD
                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF77F6454CD,?,?,?,?,00007FF77F64F1BF,?,?,00000000,00007FF77F64B9A6,?,?,?), ref: 00007FF77F64B8FA
                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF77F6454CD,?,?,?,?,00007FF77F64F1BF,?,?,00000000,00007FF77F64B9A6,?,?,?), ref: 00007FF77F64B90B
                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF77F6454CD,?,?,?,?,00007FF77F64F1BF,?,?,00000000,00007FF77F64B9A6,?,?,?), ref: 00007FF77F64B91C
                                                                            • SetLastError.KERNEL32(?,?,?,00007FF77F6454CD,?,?,?,?,00007FF77F64F1BF,?,?,00000000,00007FF77F64B9A6,?,?,?), ref: 00007FF77F64B937
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Value$ErrorLast
                                                                            • String ID:
                                                                            • API String ID: 2506987500-0
                                                                            • Opcode ID: 8f76d250fbe0b5259abb4dbde422c74cf40887be6a771761d1db9f63c6a56687
                                                                            • Instruction ID: 69cfe1a4c45783b01fa9c3eeac5f7e75ba9a655705b1fa699b4298538e633674
                                                                            • Opcode Fuzzy Hash: 8f76d250fbe0b5259abb4dbde422c74cf40887be6a771761d1db9f63c6a56687
                                                                            • Instruction Fuzzy Hash: 51118E36A3C2C241FA58776597511FBE26B5F557B0F800734D83EC76C6DE2CA60246A1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63D778 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                            • String ID: csm$f
                                                                            • API String ID: 2395640692-629598281
                                                                            • Opcode ID: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
                                                                            • Instruction ID: 6898bb0fd12e91003eb9ff5f253a0569538d35c78d7a421739e2fcf995d28040
                                                                            • Opcode Fuzzy Hash: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
                                                                            • Instruction Fuzzy Hash: 6451D833B3528586D714EB15E504ABAB76EFF40B98F918030DB5E87789DF38E9408790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F632600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                            • String ID: Unhandled exception in script
                                                                            • API String ID: 3081866767-2699770090
                                                                            • Opcode ID: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
                                                                            • Instruction ID: 8f33b36848322307c0e9bec21b21e7602dbca7db8b49868dfc04fc95f0139f55
                                                                            • Opcode Fuzzy Hash: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
                                                                            • Instruction Fuzzy Hash: 78313E33A39AC285EB20FB65E9551FAA366FF88784F800135EA4D87A59DF3CD105C750
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6329E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77F6387F2,?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F632A14
                                                                              • Part of subcall function 00007FF77F638560: GetLastError.KERNEL32(00000000,00007FF77F632A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F638587
                                                                              • Part of subcall function 00007FF77F638560: FormatMessageW.KERNEL32 ref: 00007FF77F6385B6
                                                                              • Part of subcall function 00007FF77F638AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF77F632ABB), ref: 00007FF77F638B1A
                                                                            • MessageBoxW.USER32 ref: 00007FF77F632AF0
                                                                            • MessageBoxA.USER32 ref: 00007FF77F632B0C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                            • String ID: %s%s: %s$Fatal error detected
                                                                            • API String ID: 2806210788-2410924014
                                                                            • Opcode ID: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
                                                                            • Instruction ID: 6eff2d005e8374e6b673b9b0d8ec789d56c39117e8de8e353590ebc50e55d134
                                                                            • Opcode Fuzzy Hash: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
                                                                            • Instruction Fuzzy Hash: 223172736386C181E630EB14E5516EBA369FF84B84F805036E68D93A59DF3CD205CB90
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64A018 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                            • API String ID: 4061214504-1276376045
                                                                            • Opcode ID: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
                                                                            • Instruction ID: e94a5e2bd6a70c3babc5c86a496c6231db7dece413c704e526905968903b4f8c
                                                                            • Opcode Fuzzy Hash: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
                                                                            • Instruction Fuzzy Hash: C7F04466B3964251FB107B14E9443B7D366AF49B65FD40239C56D861E4CF2CD588C3A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F659C40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _set_statfp
                                                                            • String ID:
                                                                            • API String ID: 1156100317-0
                                                                            • Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                            • Instruction ID: 3f9be5ed85f9810e71ee332913d2605f6bb097428785e9168c6a2e0044fc20d9
                                                                            • Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                            • Instruction Fuzzy Hash: 1F1189B3F38A9301F6543124E7523F794BA6F54364E840634E57EEB3D6EE2CA44041A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64B950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FlsGetValue.KERNEL32(?,?,?,00007FF77F64AB67,?,?,00000000,00007FF77F64AE02,?,?,?,?,?,00007FF77F6430CC), ref: 00007FF77F64B96F
                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF77F64AB67,?,?,00000000,00007FF77F64AE02,?,?,?,?,?,00007FF77F6430CC), ref: 00007FF77F64B98E
                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF77F64AB67,?,?,00000000,00007FF77F64AE02,?,?,?,?,?,00007FF77F6430CC), ref: 00007FF77F64B9B6
                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF77F64AB67,?,?,00000000,00007FF77F64AE02,?,?,?,?,?,00007FF77F6430CC), ref: 00007FF77F64B9C7
                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF77F64AB67,?,?,00000000,00007FF77F64AE02,?,?,?,?,?,00007FF77F6430CC), ref: 00007FF77F64B9D8
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Value
                                                                            • String ID:
                                                                            • API String ID: 3702945584-0
                                                                            • Opcode ID: 9e1f5f4a1b3245dc74612c863be46776bcdac4bc40e164520dccced427665cd5
                                                                            • Instruction ID: 5f019c9e20282d1bd58288a4253cb75347b02c4232094e9f93898d167607fd8e
                                                                            • Opcode Fuzzy Hash: 9e1f5f4a1b3245dc74612c863be46776bcdac4bc40e164520dccced427665cd5
                                                                            • Instruction Fuzzy Hash: CC116D22A3C2C241FA58776A97511FBE25B6F513B0E844334E87DC67C7DE2CE60286A1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64B7E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Value
                                                                            • String ID:
                                                                            • API String ID: 3702945584-0
                                                                            • Opcode ID: 0e11ebfcfedaf50d903662c6f8872d2c6bdf32a6161de3e830a41dec96b80c12
                                                                            • Instruction ID: 5f16f740537320a7a69a844877db472b187f2c4a739318f7bedc30234e4ec2e2
                                                                            • Opcode Fuzzy Hash: 0e11ebfcfedaf50d903662c6f8872d2c6bdf32a6161de3e830a41dec96b80c12
                                                                            • Instruction Fuzzy Hash: DA114C26E3928745F95C76758B111FB925B4F51374EC40734D83DCA2C2DD2DB60246B1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6464B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID: verbose
                                                                            • API String ID: 3215553584-579935070
                                                                            • Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
                                                                            • Instruction ID: 268964581ae55787b064250526e86a3622ed5c8f485f4ee0a3e5dca245cd3d19
                                                                            • Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
                                                                            • Instruction Fuzzy Hash: E991F7B3638686C1E720BE24D6203FEF29AAB00B54FC44135DA5D863C5DF3EDA4197A1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6505A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _invalid_parameter_noinfo
                                                                            • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                            • API String ID: 3215553584-1196891531
                                                                            • Opcode ID: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
                                                                            • Instruction ID: bb30f6741c1b779e1fb80ec76e2caf06d75508b16e56ca1589ca24fa8fbb3a6f
                                                                            • Opcode Fuzzy Hash: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
                                                                            • Instruction Fuzzy Hash: 4D81C773F38283A5FB647F2583102FAB69AAB11744FD54034CA09E7295EB2DE5019BE1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63EFD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CallEncodePointerTranslator
                                                                            • String ID: MOC$RCC
                                                                            • API String ID: 3544855599-2084237596
                                                                            • Opcode ID: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
                                                                            • Instruction ID: e9212fec1b04f4f60c9fbee5125705e09cff3933deacbeb5df037229a2ab6590
                                                                            • Opcode Fuzzy Hash: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
                                                                            • Instruction Fuzzy Hash: 4C619C33A28B858AEB149F65E5403EEB7A5FB48B88F444225EF5D53B94DF38E044C750
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63F334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                            • String ID: csm$csm
                                                                            • API String ID: 3896166516-3733052814
                                                                            • Opcode ID: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
                                                                            • Instruction ID: 495d0e51c6e91f2b49c60c32dfeb62ddbc632ce2d29cfd8519528be20c063e37
                                                                            • Opcode Fuzzy Hash: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
                                                                            • Instruction Fuzzy Hash: 2751C5335382C286EF68AF1192443AAB7AAEF54B94F844135DA6DC7786CF3CE450C791
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F632890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Message$ByteCharMultiWide
                                                                            • String ID: %s%s: %s$Fatal error detected
                                                                            • API String ID: 1878133881-2410924014
                                                                            • Opcode ID: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
                                                                            • Instruction ID: 2a8a6902d69892af6e0e504b28dab2708c594b1f87ec5ddeeb654d7319ac977b
                                                                            • Opcode Fuzzy Hash: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
                                                                            • Instruction Fuzzy Hash: 083141736386C181E620FB14E5516EBA369FF84784F804036EA8D97A99DF3CD605CB94
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F633EC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleFileNameW.KERNEL32(?,00007FF77F6339EA), ref: 00007FF77F633EF1
                                                                              • Part of subcall function 00007FF77F6329E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77F6387F2,?,?,?,?,?,?,?,?,?,?,?,00007FF77F63101D), ref: 00007FF77F632A14
                                                                              • Part of subcall function 00007FF77F6329E0: MessageBoxW.USER32 ref: 00007FF77F632AF0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorFileLastMessageModuleName
                                                                            • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                            • API String ID: 2581892565-1977442011
                                                                            • Opcode ID: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
                                                                            • Instruction ID: 81ab38c8bd02d2095ec34b81154e65fc6510067904b02dc4d80c16b5f2828514
                                                                            • Opcode Fuzzy Hash: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
                                                                            • Instruction Fuzzy Hash: 73017563B396C240FA60B724DA563F7926B6F58788FC00435D84DC7296EE1CE10997B1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64CB60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                                                            • String ID:
                                                                            • API String ID: 2718003287-0
                                                                            • Opcode ID: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
                                                                            • Instruction ID: 7f4350820496c8f91892a3696d3fe619991f1c5b94165de1ce6c82c7373713d0
                                                                            • Opcode Fuzzy Hash: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
                                                                            • Instruction Fuzzy Hash: FED11173B38A8189E710EF65C6402FDB77AFB44798B804225DE5DA7B89DE38D506C390
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F632330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: LongWindow$DialogInvalidateRect
                                                                            • String ID:
                                                                            • API String ID: 1956198572-0
                                                                            • Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
                                                                            • Instruction ID: df906c81e8b434c2d36ac0efafe8f7900595f048f069b82e115e33c8a976e25a
                                                                            • Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
                                                                            • Instruction Fuzzy Hash: 6A117322B3818282FB54A769F6442FB929BEF84B80FC48070DA4957A9DCD3CD4814650
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F65628C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                            • String ID: ?
                                                                            • API String ID: 1286766494-1684325040
                                                                            • Opcode ID: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
                                                                            • Instruction ID: 5d0303b46ce1734436870f0d0d809adc8c10e4342fb1c4303b2279b9f7463670
                                                                            • Opcode Fuzzy Hash: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
                                                                            • Instruction Fuzzy Hash: 27412713B382C282F720BB25D6453BBD66AEB807A4F904235EE5C97AD9DE3DD441C790
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F6495A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _invalid_parameter_noinfo.LIBCMT ref: 00007FF77F6495D6
                                                                              • Part of subcall function 00007FF77F64AF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF77F653392,?,?,?,00007FF77F6533CF,?,?,00000000,00007FF77F653895,?,?,00000000,00007FF77F6537C7), ref: 00007FF77F64AF22
                                                                              • Part of subcall function 00007FF77F64AF0C: GetLastError.KERNEL32(?,?,?,00007FF77F653392,?,?,?,00007FF77F6533CF,?,?,00000000,00007FF77F653895,?,?,00000000,00007FF77F6537C7), ref: 00007FF77F64AF2C
                                                                            • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF77F63BFE5), ref: 00007FF77F6495F4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
                                                                            • String ID: C:\Users\user\Desktop\QuackMod.exe
                                                                            • API String ID: 2553983749-1803517079
                                                                            • Opcode ID: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
                                                                            • Instruction ID: 7411b1b235d34cdf3bd08aa73d43136c431cd75df45cdc2a740955c920fb7517
                                                                            • Opcode Fuzzy Hash: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
                                                                            • Instruction Fuzzy Hash: 2641D233A3878296EB54FF219A504FAA79AEF817C0B944035E94D83B85EF3CD54183A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64D1F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorFileLastWrite
                                                                            • String ID: U
                                                                            • API String ID: 442123175-4171548499
                                                                            • Opcode ID: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
                                                                            • Instruction ID: 7222c9ce0a9c1b61a51b672be1a0ce60f7b73aefdc936624c81a660fc3d7bedb
                                                                            • Opcode Fuzzy Hash: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
                                                                            • Instruction Fuzzy Hash: 77418E23A38A8181DA60AB65E5443FAA6A5FB94794F804031EA4D87758DF3CD545C7A0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F64F918 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentDirectory
                                                                            • String ID: :
                                                                            • API String ID: 1611563598-336475711
                                                                            • Opcode ID: 37476e9fe501e7f44791a553affc3ffa80e4bc938821bb0c9fc6a7376d994417
                                                                            • Instruction ID: 30b1b5e6698129975f7899b2ff8d26891b1c2cabddd325f8c92018369ff1bb06
                                                                            • Opcode Fuzzy Hash: 37476e9fe501e7f44791a553affc3ffa80e4bc938821bb0c9fc6a7376d994417
                                                                            • Instruction Fuzzy Hash: E821B423A386C181EB20BB15D1452BFB3ABFB84B44F914035D69DC7289DF7CDA4587A1
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F632C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Message$ByteCharMultiWide
                                                                            • String ID: Error detected
                                                                            • API String ID: 1878133881-3513342764
                                                                            • Opcode ID: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
                                                                            • Instruction ID: a17c3e144465a72a8be73e4f95245f2b66d5e2dd520903124f9495edadf49fc4
                                                                            • Opcode Fuzzy Hash: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
                                                                            • Instruction Fuzzy Hash: B92191736386C581E720AB14E5916EBA369FF84788FC01135E68D97A69DF3CD205CBA0
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F632B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Message$ByteCharMultiWide
                                                                            • String ID: Fatal error detected
                                                                            • API String ID: 1878133881-4025702859
                                                                            • Opcode ID: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
                                                                            • Instruction ID: a158ba69c5369af55b5937039fce840276eda2de3931e143a0468faf71164ac8
                                                                            • Opcode Fuzzy Hash: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
                                                                            • Instruction Fuzzy Hash: 76219173638AC181EB20EB14E5516EBA369FF84788FC05135E68D97A69DF3CD205CB60
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F63FE80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ExceptionFileHeaderRaise
                                                                            • String ID: csm
                                                                            • API String ID: 2573137834-1018135373
                                                                            • Opcode ID: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
                                                                            • Instruction ID: 08fccafbee966a537e0c802c6e71c4585aa0ab393149483c6808e104cdf7665d
                                                                            • Opcode Fuzzy Hash: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
                                                                            • Instruction Fuzzy Hash: 4A116033628B8182EB649F19F5402AAB7E5FB88B84F984234EE9C47759DF3CC551C740
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF77F65041C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000000.00000002.3296694247.00007FF77F631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77F630000, based on PE: true
                                                                            • Associated: 00000000.00000002.3296632762.00007FF77F630000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296754701.00007FF77F65B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F66E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296791206.00007FF77F670000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                            • Associated: 00000000.00000002.3296864064.00007FF77F672000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_0_2_7ff77f630000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: DriveType_invalid_parameter_noinfo
                                                                            • String ID: :
                                                                            • API String ID: 2595371189-336475711
                                                                            • Opcode ID: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
                                                                            • Instruction ID: f538152abde22a5b1375286217c424cb4c8c6d454c7ce9e018e79b00a29e9a8e
                                                                            • Opcode Fuzzy Hash: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
                                                                            • Instruction Fuzzy Hash: 2D015E27A3828385EB20BB6096612BFA2A9EF44705FC40035D54DC7695EF2CE504CB64
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Execution Graph

                                                                            Execution Coverage:5.3%
                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                            Signature Coverage:0.7%
                                                                            Total number of Nodes:2000
                                                                            Total number of Limit Nodes:84
                                                                            execution_graph 73388 7ff8a88061a6 73391 7ff8a88061af 73388->73391 73396 7ff8a88062a2 73388->73396 73389 7ff8a88062d1 DefWindowProcW 73390 7ff8a88062e4 73389->73390 73391->73390 73392 7ff8a8806287 SendMessageW 73391->73392 73394 7ff8a8806230 73391->73394 73391->73396 73392->73390 73393 7ff8a880629d 73392->73393 73393->73394 73393->73396 73394->73390 73395 7ff8a8806271 SetFocus 73394->73395 73394->73396 73395->73390 73396->73389 73396->73390 73397 7ff8a884894d 73402 7ff8a8848960 73397->73402 73398 7ff8a8848997 strncmp 73398->73402 73399 7ff8a88489da strncmp 73399->73402 73400 7ff8a8848a1c strncmp 73400->73402 73401 7ff8a8848a94 strncmp 73401->73402 73402->73398 73402->73399 73402->73400 73402->73401 73403 7ff8a8848a5b strncmp 73402->73403 73404 7ff8a8848ace 73402->73404 73403->73402 73405 7ff8a887bc70 621 API calls 73404->73405 73406 7ff8a8848bca 73404->73406 73414 7ff8a8848ddd 73404->73414 73405->73406 73407 7ff8a8848c15 73406->73407 73415 7ff8a887bc70 73406->73415 73409 7ff8a887bc70 621 API calls 73407->73409 73410 7ff8a8848c5a 73407->73410 73407->73414 73409->73410 73411 7ff8a887bc70 621 API calls 73410->73411 73412 7ff8a8848c78 73410->73412 73411->73412 73413 7ff8a8848d91 memset 73412->73413 73412->73414 73413->73414 73416 7ff8a887bca9 73415->73416 73417 7ff8a887bcc2 strchr 73416->73417 73422 7ff8a887cb20 73416->73422 73420 7ff8a887bce4 73417->73420 73419 7ff8a887be1a strncpy 73421 7ff8a887be39 73419->73421 73420->73419 73420->73421 73421->73407 73423 7ff8a887cb5b 73422->73423 73424 7ff8a887cb71 73423->73424 73430 7ff8a887d100 73423->73430 73426 7ff8a887cb20 620 API calls 73424->73426 73428 7ff8a887cb95 73424->73428 73426->73428 73427 7ff8a887ce45 memcpy 73429 7ff8a887ce6e 73427->73429 73428->73427 73428->73429 73429->73417 73431 7ff8a887d12c 73430->73431 73435 7ff8a8625c21 73431->73435 73569 7ff8a8624c27 73431->73569 73437 7ff8a8625c5f 73435->73437 73436 7ff8a8625c71 73439 7ff8a8625caa strstr 73436->73439 73443 7ff8a8625db1 73436->73443 73437->73436 74231 7ff8a8628970 116 API calls 73437->74231 73440 7ff8a8625cc6 73439->73440 73441 7ff8a8625d16 73440->73441 74232 7ff8a8628970 116 API calls 73440->74232 73441->73443 73445 7ff8a8625d45 strstr 73441->73445 73444 7ff8a86e7f10 617 API calls 73443->73444 73452 7ff8a8625e36 73443->73452 73444->73452 73446 7ff8a8625d61 73445->73446 73446->73443 74233 7ff8a8628970 116 API calls 73446->74233 73448 7ff8a8625f7b 73486 7ff8a8626fbb 73448->73486 73784 7ff8a86e7f10 73448->73784 73449 7ff8a8625ec3 strstr 73449->73452 73451 7ff8a86e7f10 617 API calls 73451->73452 73452->73448 73452->73449 73452->73451 73452->73486 74234 7ff8a8628970 116 API calls 73452->74234 73453 7ff8a8626120 73877 7ff8a86bbcc0 73453->73877 73460 7ff8a862614d 74044 7ff8a8730f20 73460->74044 73461 7ff8a862605f strstr 73463 7ff8a8625fb1 73461->73463 73463->73453 73463->73461 73463->73486 74235 7ff8a8628970 116 API calls 73463->74235 73465 7ff8a8626152 73466 7ff8a8730f20 28 API calls 73465->73466 73497 7ff8a862715a 73465->73497 73467 7ff8a862619c 73466->73467 73468 7ff8a8730f20 28 API calls 73467->73468 73467->73497 73469 7ff8a86261e8 73468->73469 73470 7ff8a862627f 73469->73470 73469->73497 74236 7ff8a8704170 53 API calls 73469->74236 73472 7ff8a86262ca 73470->73472 74278 7ff8a871a870 36 API calls 73486->74278 73493 7ff8a862711a 74279 7ff8a871a870 36 API calls 73493->74279 73498 7ff8a862713a 74280 7ff8a871a870 36 API calls 73498->74280 73570 7ff8a8624c33 73569->73570 73571 7ff8a8624c99 LeaveCriticalSection 73570->73571 73572 7ff8a8624cb0 73571->73572 73573 7ff8a8703a00 28 API calls 73572->73573 73574 7ff8a8624cdb 73573->73574 73575 7ff8a8730f20 28 API calls 73574->73575 73576 7ff8a8624f00 73575->73576 73577 7ff8a862715a 73576->73577 73578 7ff8a8730f20 28 API calls 73576->73578 73579 7ff8a8624f8a 73578->73579 73580 7ff8a8730f20 28 API calls 73579->73580 73581 7ff8a8624fb8 73580->73581 73582 7ff8a8730f20 28 API calls 73581->73582 73583 7ff8a862502c 73582->73583 73584 7ff8a8730f20 28 API calls 73583->73584 73585 7ff8a862509e 73584->73585 73586 7ff8a8730f20 28 API calls 73585->73586 73587 7ff8a862511c 73586->73587 73588 7ff8a8730f20 28 API calls 73587->73588 73589 7ff8a8625147 73588->73589 73589->73577 73590 7ff8a8625164 _wgetenv 73589->73590 73591 7ff8a8703a00 28 API calls 73590->73591 73592 7ff8a8625304 GetCurrentThreadId _wgetenv 73591->73592 73593 7ff8a8625331 73592->73593 75609 7ff8a86a15e0 73593->75609 73595 7ff8a86254e2 73596 7ff8a8703a00 28 API calls 73595->73596 73597 7ff8a86254f5 73596->73597 75617 7ff8a86247a0 TlsGetValue 73597->75617 73599 7ff8a8625524 73600 7ff8a8625558 LeaveCriticalSection 73599->73600 73601 7ff8a8779a50 3 API calls 73600->73601 73602 7ff8a862562e TlsGetValue 73601->73602 73603 7ff8a862565a 73602->73603 73605 7ff8a8625683 73603->73605 73611 7ff8a862569c 73603->73611 73614 7ff8a8626f9c 73603->73614 75818 7ff8a8731890 49 API calls 73605->75818 73608 7ff8a869a0c0 606 API calls 73609 7ff8a86257b5 73608->73609 73611->73614 75626 7ff8a869a0c0 73611->75626 75847 7ff8a871a870 36 API calls 73614->75847 73633 7ff8a862711a 75848 7ff8a871a870 36 API calls 73633->75848 73640 7ff8a862713a 75849 7ff8a871a870 36 API calls 73640->75849 73786 7ff8a86e7f29 73784->73786 73785 7ff8a86e7f8e 73789 7ff8a8730c00 28 API calls 73785->73789 73786->73785 73788 7ff8a86e7f9a 73786->73788 73790 7ff8a8730c00 28 API calls 73786->73790 73787 7ff8a86e83d2 74313 7ff8a8722d10 165 API calls 73787->74313 73788->73787 73796 7ff8a86e803f 73788->73796 73789->73788 73790->73786 73792 7ff8a86e83e1 74314 7ff8a871a7c0 53 API calls 73792->74314 73794 7ff8a86e83ec 74315 7ff8a871b210 165 API calls 73794->74315 73797 7ff8a86e80f0 TlsAlloc 73796->73797 73798 7ff8a86e810f TlsGetValue 73796->73798 73804 7ff8a86e80e0 73796->73804 73809 7ff8a86e80d1 73796->73809 73797->73798 73822 7ff8a86e8415 73797->73822 73801 7ff8a86e8127 GetLastError 73798->73801 73802 7ff8a86e8135 73798->73802 73800 7ff8a86e8370 memcpy 73800->73804 73801->73802 73801->73822 73806 7ff8a86e813f 73802->73806 74281 7ff8a87308b0 73802->74281 73803 7ff8a86e81ec 73803->73800 73804->73463 73807 7ff8a86e81fa GetProcessHeap HeapReAlloc 73806->73807 73810 7ff8a86e8174 73806->73810 73806->73822 73807->73809 73808 7ff8a86e8595 73808->73463 73809->73800 73809->73803 73809->73822 73810->73809 73811 7ff8a86e8253 memcpy 73810->73811 73812 7ff8a86e8274 TlsAlloc 73811->73812 73813 7ff8a86e8293 TlsGetValue 73811->73813 73812->73813 73812->73822 73816 7ff8a86e82ab GetLastError 73813->73816 73817 7ff8a86e82b9 73813->73817 73815 7ff8a8730f20 28 API calls 73815->73822 73816->73817 73816->73822 73818 7ff8a86e82c3 73817->73818 73819 7ff8a87308b0 22 API calls 73817->73819 73821 7ff8a86e82e3 GetProcessHeap HeapFree 73818->73821 73818->73822 73824 7ff8a86e8316 73818->73824 73819->73818 73821->73809 73822->73808 73822->73815 73823 7ff8a86e8528 memcpy 73822->73823 73826 7ff8a86e85ba 73822->73826 74316 7ff8a86dfff0 165 API calls 73822->74316 73823->73822 73824->73809 74312 7ff8a87313d0 LeaveCriticalSection 73824->74312 74317 7ff8a86e98b0 167 API calls 73826->74317 73828 7ff8a86e8629 73829 7ff8a8730f20 28 API calls 73828->73829 73874 7ff8a86e8799 73828->73874 73835 7ff8a86e863d 73829->73835 73830 7ff8a86e87bf 73832 7ff8a8730f20 28 API calls 73830->73832 73831 7ff8a86e883d 73833 7ff8a86e88d4 73831->73833 73834 7ff8a86e888b 73831->73834 73843 7ff8a86e87c4 73832->73843 73839 7ff8a86e892a 73833->73839 73844 7ff8a86e88e3 73833->73844 73845 7ff8a86e8909 73833->73845 74339 7ff8a8722d10 165 API calls 73834->74339 73837 7ff8a86e8701 73835->73837 73838 7ff8a86e86a8 73835->73838 73848 7ff8a86e8a69 73835->73848 73840 7ff8a8730f20 28 API calls 73837->73840 73856 7ff8a8730f20 28 API calls 73838->73856 73842 7ff8a86e893c strpbrk 73839->73842 73875 7ff8a86e898f 73839->73875 73847 7ff8a86e8706 73840->73847 73841 7ff8a86e889a 74340 7ff8a871a7c0 53 API calls 73841->74340 73850 7ff8a86e8951 73842->73850 73842->73875 73843->73848 74337 7ff8a871a7c0 53 API calls 73843->74337 74342 7ff8a8722d10 165 API calls 73844->74342 74344 7ff8a8722d10 165 API calls 73845->74344 74318 7ff8a862aed0 28 API calls 73847->74318 73853 7ff8a86e8833 73850->73853 74346 7ff8a86e8aa0 185 API calls 73850->74346 73853->73463 73854 7ff8a86e891f 74345 7ff8a871a7c0 53 API calls 73854->74345 73855 7ff8a86e88a5 74341 7ff8a871b210 165 API calls 73855->74341 73868 7ff8a86e86be 73856->73868 73857 7ff8a86e8811 74338 7ff8a871b210 165 API calls 73857->74338 73858 7ff8a86e88f6 74343 7ff8a871a7c0 53 API calls 73858->74343 73864 7ff8a86e875e 74319 7ff8a862b470 73864->74319 73868->73847 73868->73848 73870 7ff8a86e86e1 memcpy 73868->73870 73870->73847 73871 7ff8a86e8783 73871->73874 74336 7ff8a8704170 53 API calls 73871->74336 73874->73830 73874->73831 73874->73853 73875->73853 74347 7ff8a873c2b0 tolower tolower tolower tolower 73875->74347 74348 7ff8a86e8aa0 185 API calls 73875->74348 73878 7ff8a86bbcd3 73877->73878 73879 7ff8a86bbcdf 73878->73879 73882 7ff8a86bbde7 73878->73882 75044 7ff8a86288a0 117 API calls 73879->75044 73881 7ff8a86bbdc2 75045 7ff8a8627260 621 API calls 73881->75045 73887 7ff8a86bbe7c 73882->73887 75046 7ff8a86b8b60 73882->75046 73884 7ff8a8626128 73895 7ff8a869dd50 73884->73895 73886 7ff8a86bbe48 73888 7ff8a86bbe67 73886->73888 75061 7ff8a8629830 112 API calls 73886->75061 75062 7ff8a8630120 28 API calls 73887->75062 73888->73887 73891 7ff8a86b8b60 36 API calls 73888->73891 73891->73887 73892 7ff8a86bbe18 73892->73886 75060 7ff8a8629830 112 API calls 73892->75060 75064 7ff8a8737320 73895->75064 73897 7ff8a869dda7 73898 7ff8a8730f20 28 API calls 73897->73898 73899 7ff8a869ddac 73898->73899 73900 7ff8a869df57 __p__wenviron 73899->73900 73910 7ff8a869df50 73899->73910 73912 7ff8a869e3a7 73899->73912 73918 7ff8a86b88d0 609 API calls 73899->73918 73901 7ff8a869df70 __p__wenviron 73900->73901 73902 7ff8a869df63 _wgetenv 73900->73902 73903 7ff8a869df83 73901->73903 73915 7ff8a869e29a 73901->73915 73902->73901 73904 7ff8a869df8f __p__wenviron 73903->73904 73906 7ff8a869e28d LeaveCriticalSection 73904->73906 73917 7ff8a869dfa2 73904->73917 73905 7ff8a869e2fc 73907 7ff8a86b8b60 36 API calls 73905->73907 73906->73915 73909 7ff8a869e308 73907->73909 73908 7ff8a869dfa8 __p__wenviron 73908->73917 73921 7ff8a869e31e 73909->73921 75078 7ff8a8704170 53 API calls 73909->75078 73910->73900 73913 7ff8a869dff8 strchr 73916 7ff8a869e040 _stricmp 73913->73916 73913->73917 73915->73905 75077 7ff8a8742220 165 API calls 73915->75077 73916->73917 73919 7ff8a869e060 _stricmp 73916->73919 73917->73908 73917->73912 73917->73913 73922 7ff8a869e26e __p__wenviron 73917->73922 73924 7ff8a8730c00 28 API calls 73917->73924 73930 7ff8a8730f20 28 API calls 73917->73930 73931 7ff8a869e0c4 memcpy 73917->73931 73932 7ff8a869e14e memcpy 73917->73932 73934 7ff8a8704170 53 API calls 73917->73934 75074 7ff8a87378b0 30 API calls 73917->75074 75075 7ff8a8741390 257 API calls 73917->75075 75076 7ff8a8704170 53 API calls 73917->75076 73918->73899 73919->73917 73921->73912 73923 7ff8a8737720 194 API calls 73921->73923 73922->73906 73922->73908 73925 7ff8a869e35e 73923->73925 73924->73917 73926 7ff8a869e36a 73925->73926 73927 7ff8a8730c00 28 API calls 73925->73927 73928 7ff8a877ae00 8 API calls 73926->73928 73927->73926 73929 7ff8a8626130 73928->73929 73936 7ff8a86851d0 73929->73936 73930->73917 73931->73917 73932->73917 73934->73917 73940 7ff8a868520f 73936->73940 73937 7ff8a8685299 73942 7ff8a8730f20 28 API calls 73937->73942 73938 7ff8a86852f3 73939 7ff8a8730f20 28 API calls 73938->73939 73941 7ff8a86852f8 73939->73941 73940->73937 73940->73938 73959 7ff8a86856e4 73940->73959 75198 7ff8a8685cf0 621 API calls 73941->75198 73946 7ff8a86852ae 73942->73946 73944 7ff8a8685329 73945 7ff8a868534c 73944->73945 75199 7ff8a8688820 165 API calls 73944->75199 73949 7ff8a8685380 73945->73949 73950 7ff8a8685371 73945->73950 73946->73941 73948 7ff8a86852d2 memcpy 73946->73948 73946->73959 73948->73941 75201 7ff8a86898c0 73949->75201 73967 7ff8a868537e 73950->73967 75200 7ff8a8704370 29 API calls 73950->75200 73952 7ff8a868545a 73954 7ff8a8689270 617 API calls 73952->73954 73955 7ff8a8685472 73954->73955 75226 7ff8a873ce90 73955->75226 73957 7ff8a8730f20 28 API calls 73957->73967 73958 7ff8a86854b0 73958->73959 73960 7ff8a868556e 73958->73960 73968 7ff8a868553e 73958->73968 73970 7ff8a868558f 73958->73970 74021 7ff8a868587d 73959->74021 75234 7ff8a86b9ae0 178 API calls 73959->75234 75232 7ff8a8730d50 TlsGetValue 73960->75232 73961 7ff8a86855ff strstr 73962 7ff8a86853ef memcpy 73962->73967 73967->73952 73967->73957 73967->73959 73967->73962 75206 7ff8a8632560 35 API calls 73967->75206 75207 7ff8a8689270 73967->75207 73968->73959 73969 7ff8a8685555 memcpy 73968->73969 73969->73970 73970->73959 73970->73961 73971 7ff8a868580c 73971->74021 75235 7ff8a8685cf0 621 API calls 73971->75235 73975 7ff8a877ae00 8 API calls 73978 7ff8a8685b8d 73975->73978 73977 7ff8a868581c 73980 7ff8a8685837 73977->73980 75236 7ff8a8688820 165 API calls 73977->75236 73978->73460 73986 7ff8a8685b9e 73980->73986 73987 7ff8a8685862 73980->73987 73988 7ff8a8730f20 28 API calls 73986->73988 73989 7ff8a86859fb 73987->73989 73993 7ff8a868586e 73987->73993 73990 7ff8a8685ba3 73988->73990 73991 7ff8a8685a32 73989->73991 73989->74021 75245 7ff8a8688820 165 API calls 73989->75245 73995 7ff8a8685bbe 73990->73995 74018 7ff8a8685c37 73990->74018 73998 7ff8a8685ad7 73991->73998 74002 7ff8a8685a59 73991->74002 73994 7ff8a8685896 73993->73994 73993->74018 73993->74021 75237 7ff8a8688820 165 API calls 73993->75237 75238 7ff8a86dfbb0 34 API calls 73994->75238 75252 7ff8a871a7c0 53 API calls 73995->75252 74003 7ff8a8730f20 28 API calls 73998->74003 74000 7ff8a86858b0 74004 7ff8a86858b8 74000->74004 74005 7ff8a8685937 74000->74005 74011 7ff8a8685a8d 74002->74011 74002->74021 75246 7ff8a8632840 28 API calls 74002->75246 74007 7ff8a8685adc 74003->74007 74009 7ff8a8730f20 28 API calls 74004->74009 74008 7ff8a86859e9 74005->74008 74039 7ff8a8685950 74005->74039 75241 7ff8a8688820 165 API calls 74005->75241 74006 7ff8a8685ca9 75254 7ff8a8689430 165 API calls 74006->75254 74007->74018 74023 7ff8a8685af7 74007->74023 75244 7ff8a871a7c0 53 API calls 74008->75244 74015 7ff8a86858bd 74009->74015 75247 7ff8a8694000 31 API calls 74011->75247 74015->74018 74030 7ff8a86858d7 74015->74030 74016 7ff8a8685cb6 74022 7ff8a8685cca 74016->74022 75255 7ff8a8704170 53 API calls 74016->75255 75253 7ff8a8685cf0 621 API calls 74018->75253 74019 7ff8a8685aa5 75248 7ff8a871f9c0 29 API calls 74019->75248 74021->73975 74026 7ff8a8685cd8 74022->74026 74031 7ff8a8730c00 28 API calls 74022->74031 75250 7ff8a871a7c0 53 API calls 74023->75250 74028 7ff8a8685b38 75251 7ff8a871b210 165 API calls 74028->75251 74029 7ff8a8685ab1 75249 7ff8a871a7c0 53 API calls 74029->75249 75239 7ff8a871a7c0 53 API calls 74030->75239 74031->74026 74034 7ff8a8685abc 74034->74021 74036 7ff8a8685919 74039->74008 74039->74018 74040 7ff8a86859c7 74039->74040 75242 7ff8a86dfff0 165 API calls 74039->75242 74040->74008 75243 7ff8a86881b0 53 API calls 74040->75243 74045 7ff8a8730f2d TlsAlloc 74044->74045 74046 7ff8a8730f4c TlsGetValue 74044->74046 74045->74046 74048 7ff8a8730f69 GetLastError 74046->74048 74049 7ff8a8730f77 74046->74049 74048->74049 74050 7ff8a87308b0 22 API calls 74049->74050 74054 7ff8a8730f81 74049->74054 74050->74054 74051 7ff8a873107a 74051->73465 74052 7ff8a8731001 LeaveCriticalSection 74052->74051 74053 7ff8a8731018 GetProcessHeap HeapAlloc 74052->74053 74055 7ff8a873103e 74053->74055 74054->74051 74054->74052 74054->74054 74055->74051 74231->73436 74232->73441 74233->73443 74234->73452 74235->73463 74236->73470 74278->73493 74279->73498 74280->73497 74282 7ff8a87309e9 74281->74282 74283 7ff8a87308cd 74281->74283 74349 7ff8a8779a50 74282->74349 74285 7ff8a87308ed 74283->74285 74286 7ff8a87308d6 InitializeCriticalSection 74283->74286 74292 7ff8a87309dc LeaveCriticalSection 74285->74292 74293 7ff8a8730907 malloc 74285->74293 74286->74285 74287 7ff8a87309ee 74288 7ff8a8730a71 74287->74288 74289 7ff8a87309f6 GetProcessHeap HeapAlloc 74287->74289 74288->73806 74290 7ff8a8730a84 74289->74290 74291 7ff8a8730a15 memset 74289->74291 74301 7ff8a8730a91 74290->74301 74294 7ff8a87795c0 74291->74294 74292->74282 74295 7ff8a873091e InitializeCriticalSection malloc 74293->74295 74293->74301 74296 7ff8a8730a31 LeaveCriticalSection GetCurrentThreadId TlsSetValue 74294->74296 74297 7ff8a8730949 InitializeCriticalSection 74295->74297 74295->74301 74296->74288 74296->74301 74298 7ff8a8730970 malloc 74297->74298 74300 7ff8a87309c0 InitializeCriticalSection 74298->74300 74298->74301 74300->74292 74300->74298 74302 7ff8a8730ac1 TlsAlloc 74301->74302 74303 7ff8a8730ae0 TlsGetValue 74302->74303 74308 7ff8a8730be4 74302->74308 74305 7ff8a8730b0b 74303->74305 74306 7ff8a8730afd GetLastError 74303->74306 74307 7ff8a8730b1a GetProcessHeap RtlAllocateHeap 74305->74307 74309 7ff8a87308b0 3 API calls 74305->74309 74306->74305 74306->74308 74311 7ff8a8730b57 74307->74311 74309->74307 74311->73806 74312->73809 74313->73792 74314->73794 74315->73804 74316->73822 74317->73828 74318->73864 74320 7ff8a862b48f 74319->74320 74324 7ff8a862b494 74319->74324 74470 7ff8a871a870 36 API calls 74320->74470 74322 7ff8a862b50a 74322->73871 74335 7ff8a8704170 53 API calls 74322->74335 74324->74322 74355 7ff8a880049e 74324->74355 74358 7ff8a863bd40 74324->74358 74371 7ff8a863c470 74324->74371 74393 7ff8a8852d51 74324->74393 74397 7ff8a863c6a0 74324->74397 74402 7ff8a863c110 74324->74402 74415 7ff8a863bd90 74324->74415 74428 7ff8a8813576 74324->74428 74431 7ff8a863a8f0 74324->74431 74439 7ff8a863bf00 74324->74439 74471 7ff8a87310d0 24 API calls 74324->74471 74335->73871 74336->73874 74337->73857 74338->73853 74339->73841 74340->73855 74341->73853 74342->73858 74343->73857 74344->73854 74345->73839 74346->73853 74347->73875 74348->73875 74350 7ff8a8779a5d TlsAlloc 74349->74350 74351 7ff8a8779a78 TlsGetValue 74349->74351 74350->74351 74354 7ff8a8779a9f 74350->74354 74353 7ff8a8779a95 GetLastError 74351->74353 74351->74354 74353->74354 74354->74287 74472 7ff8a88028b0 74355->74472 74357 7ff8a88004b1 74357->74324 74359 7ff8a863bd53 74358->74359 74360 7ff8a863bd71 74358->74360 74359->74324 74524 7ff8a870d720 74360->74524 74364 7ff8a8705620 34 API calls 74366 7ff8a863cb52 74364->74366 74365 7ff8a863cb1d 74367 7ff8a863cb35 _errno 74365->74367 74369 7ff8a863cb11 74365->74369 74563 7ff8a871a7c0 53 API calls 74366->74563 74367->74369 74369->74364 74370 7ff8a863cb5d 74370->74324 74372 7ff8a863c4ad 74371->74372 74373 7ff8a863c486 74371->74373 74607 7ff8a86d7580 74372->74607 74373->74324 74375 7ff8a863c4b6 74376 7ff8a863c56b 74375->74376 74377 7ff8a863c4bf 74375->74377 74674 7ff8a871a7c0 53 API calls 74376->74674 74378 7ff8a8730f20 28 API calls 74377->74378 74380 7ff8a863c4c9 74378->74380 74382 7ff8a863c4e8 74380->74382 74384 7ff8a863c583 74380->74384 74381 7ff8a863c576 74381->74324 74672 7ff8a871a7c0 53 API calls 74382->74672 74385 7ff8a863c5b2 74384->74385 74625 7ff8a870cdf0 74384->74625 74385->74324 74387 7ff8a863c522 74673 7ff8a871b210 165 API calls 74387->74673 74388 7ff8a863c5e4 74675 7ff8a871a7c0 53 API calls 74388->74675 74391 7ff8a863c556 74391->74324 74392 7ff8a863c5ef 74392->74324 74394 7ff8a8852da7 74393->74394 74395 7ff8a8852d61 74393->74395 74394->74395 74826 7ff8a885dce0 74394->74826 74395->74324 74398 7ff8a863c6b5 74397->74398 74399 7ff8a863c6d4 74397->74399 74398->74324 74399->74398 74882 7ff8a871a7c0 53 API calls 74399->74882 74401 7ff8a863c6ed 74401->74324 74403 7ff8a863c123 74402->74403 74404 7ff8a863c141 74402->74404 74403->74324 74405 7ff8a870d720 105 API calls 74404->74405 74406 7ff8a863cb0d 74405->74406 74407 7ff8a86d7420 181 API calls 74406->74407 74413 7ff8a863cb11 74406->74413 74409 7ff8a863cb1d 74407->74409 74408 7ff8a8705620 34 API calls 74410 7ff8a863cb52 74408->74410 74411 7ff8a863cb35 _errno 74409->74411 74409->74413 74883 7ff8a871a7c0 53 API calls 74410->74883 74411->74413 74413->74408 74414 7ff8a863cb5d 74414->74324 74416 7ff8a863bda3 74415->74416 74417 7ff8a863bdc1 74415->74417 74416->74324 74418 7ff8a870d720 105 API calls 74417->74418 74419 7ff8a863cb0d 74418->74419 74420 7ff8a86d7420 181 API calls 74419->74420 74426 7ff8a863cb11 74419->74426 74422 7ff8a863cb1d 74420->74422 74421 7ff8a8705620 34 API calls 74423 7ff8a863cb52 74421->74423 74424 7ff8a863cb35 _errno 74422->74424 74422->74426 74884 7ff8a871a7c0 53 API calls 74423->74884 74424->74426 74426->74421 74427 7ff8a863cb5d 74427->74324 74885 7ff8a8813610 74428->74885 74430 7ff8a88135a1 74430->74324 74432 7ff8a863a93a 74431->74432 74434 7ff8a863a91a 74431->74434 74437 7ff8a863a949 74432->74437 74954 7ff8a873bb50 169 API calls 74432->74954 74434->74324 74435 7ff8a863a9ea 74908 7ff8a862d810 74435->74908 74436 7ff8a8730f20 28 API calls 74436->74435 74437->74435 74437->74436 74440 7ff8a863bf12 74439->74440 74441 7ff8a863bf34 74439->74441 74440->74324 74442 7ff8a863bf6f GetNamedSecurityInfoW 74441->74442 74443 7ff8a863bfa6 GetCurrentProcess OpenProcessToken 74442->74443 74451 7ff8a863c074 74442->74451 74445 7ff8a863c057 74443->74445 74446 7ff8a863bfc5 GetTokenInformation 74443->74446 74444 7ff8a8705620 34 API calls 74449 7ff8a863c081 74444->74449 74447 7ff8a863c061 LocalFree 74445->74447 74448 7ff8a863c067 74445->74448 74450 7ff8a863c04c CloseHandle 74446->74450 74456 7ff8a863bff8 74446->74456 74447->74448 74448->74451 74453 7ff8a8730c00 28 API calls 74448->74453 75042 7ff8a871a7c0 53 API calls 74449->75042 74450->74445 74451->74444 74453->74451 74454 7ff8a863c08c 74454->74324 74455 7ff8a863c00f GetTokenInformation 74455->74450 74457 7ff8a863c03b EqualSid 74455->74457 74456->74455 74459 7ff8a863c0ae 74456->74459 74457->74450 74458 7ff8a863c0d3 74458->74324 74459->74458 74460 7ff8a870d720 105 API calls 74459->74460 74461 7ff8a863cb0d 74460->74461 74462 7ff8a86d7420 181 API calls 74461->74462 74468 7ff8a863cb11 74461->74468 74464 7ff8a863cb1d 74462->74464 74463 7ff8a8705620 34 API calls 74465 7ff8a863cb52 74463->74465 74466 7ff8a863cb35 _errno 74464->74466 74464->74468 75043 7ff8a871a7c0 53 API calls 74465->75043 74466->74468 74468->74463 74469 7ff8a863cb5d 74469->74324 74470->74324 74471->74324 74473 7ff8a8802918 strcmp 74472->74473 74475 7ff8a88028f6 74472->74475 74476 7ff8a8802937 74473->74476 74475->74357 74476->74475 74477 7ff8a8802a2b memset 74476->74477 74478 7ff8a8802cb8 74477->74478 74483 7ff8a8802a49 74477->74483 74487 7ff8a87fdb90 74478->74487 74482 7ff8a8802b44 CreateDIBSection 74482->74475 74482->74483 74483->74478 74483->74482 74484 7ff8a8802c1c CreateDIBSection 74483->74484 74485 7ff8a8802c4b memset CreateIconIndirect DeleteObject DeleteObject 74484->74485 74486 7ff8a8802d4a DeleteObject 74484->74486 74485->74475 74485->74483 74486->74475 74488 7ff8a87fdbb6 74487->74488 74489 7ff8a87fddcd 74488->74489 74490 7ff8a87fdc5a 74488->74490 74510 7ff8a87fdbd0 74488->74510 74491 7ff8a87fdddc 74489->74491 74492 7ff8a87fd9b0 5 API calls 74489->74492 74493 7ff8a87fdcb0 74490->74493 74494 7ff8a87fdc6f 74490->74494 74495 7ff8a87fde65 SendMessageW 74491->74495 74508 7ff8a87fde7e SendMessageW 74491->74508 74491->74510 74492->74491 74496 7ff8a87fdcb5 SetClassLongPtrW 74493->74496 74509 7ff8a87fdcca SetClassLongPtrW 74493->74509 74512 7ff8a87fd9b0 74494->74512 74498 7ff8a87fdf2a SendMessageW 74495->74498 74499 7ff8a87fdd79 SetClassLongPtrW 74496->74499 74501 7ff8a87fdf4c 74498->74501 74498->74510 74506 7ff8a87fdda3 74499->74506 74523 7ff8a87fe100 DestroyIcon 74501->74523 74503 7ff8a87fdef0 74503->74498 74505 7ff8a87fdd39 74505->74499 74506->74510 74522 7ff8a87fe100 DestroyIcon 74506->74522 74508->74498 74508->74503 74509->74499 74509->74505 74510->74475 74511 7ff8a87fe100 DestroyIcon 74510->74511 74511->74475 74513 7ff8a87fd9db 74512->74513 74514 7ff8a87fda55 GetModuleHandleW 74513->74514 74515 7ff8a87fda64 74513->74515 74520 7ff8a87fdb2d 74513->74520 74514->74515 74517 7ff8a87fda8b GetModuleHandleW 74515->74517 74518 7ff8a87fda9a LoadIconW 74515->74518 74521 7ff8a87fdab1 74515->74521 74516 7ff8a87fdb76 74516->74510 74517->74518 74519 7ff8a87fdb0b LoadCursorW RegisterClassW 74518->74519 74519->74520 74520->74510 74521->74516 74521->74519 74522->74510 74523->74510 74525 7ff8a863cb0d 74524->74525 74526 7ff8a870d73d 74524->74526 74525->74369 74530 7ff8a86d7420 74525->74530 74526->74525 74527 7ff8a870d762 74526->74527 74564 7ff8a870ed50 105 API calls 74526->74564 74565 7ff8a870eae0 53 API calls 74527->74565 74531 7ff8a86d7435 74530->74531 74532 7ff8a86d7554 74530->74532 74531->74532 74533 7ff8a86d743d 74531->74533 74547 7ff8a870e465 74532->74547 74551 7ff8a86d7420 181 API calls 74532->74551 74556 7ff8a870e477 74532->74556 74598 7ff8a870ed50 105 API calls 74532->74598 74599 7ff8a870eae0 53 API calls 74532->74599 74600 7ff8a870e5d0 180 API calls 74532->74600 74566 7ff8a86d35a0 TlsGetValue 74533->74566 74537 7ff8a86d74fb 74541 7ff8a86d3880 50 API calls 74537->74541 74538 7ff8a86d749c 74538->74537 74542 7ff8a86d74b7 74538->74542 74552 7ff8a86d74c1 74538->74552 74539 7ff8a86d7459 74539->74538 74544 7ff8a86d748a 74539->74544 74539->74552 74588 7ff8a870ed50 105 API calls 74539->74588 74545 7ff8a86d74bc 74541->74545 74591 7ff8a86d3880 TlsGetValue 74542->74591 74589 7ff8a870eae0 53 API calls 74544->74589 74545->74365 74547->74365 74551->74532 74552->74537 74554 7ff8a86d7518 74552->74554 74553 7ff8a86d7492 74590 7ff8a870e5d0 180 API calls 74553->74590 74557 7ff8a86d7531 74554->74557 74596 7ff8a870e5d0 180 API calls 74554->74596 74556->74547 74601 7ff8a86d3910 50 API calls 74556->74601 74561 7ff8a86d7546 74557->74561 74597 7ff8a86d3910 50 API calls 74557->74597 74562 7ff8a86d3880 50 API calls 74561->74562 74562->74545 74563->74370 74564->74527 74565->74525 74569 7ff8a86d35c9 74566->74569 74567 7ff8a86d362a 74568 7ff8a86d364b TlsGetValue 74567->74568 74570 7ff8a86d379c 74567->74570 74573 7ff8a86d3669 74568->74573 74569->74567 74571 7ff8a86d3606 74569->74571 74580 7ff8a86d37c2 74569->74580 74583 7ff8a86d37f0 TlsGetValue 74570->74583 74602 7ff8a8731890 49 API calls 74571->74602 74574 7ff8a86d3692 74573->74574 74577 7ff8a86d36b5 74573->74577 74573->74580 74603 7ff8a8731890 49 API calls 74574->74603 74576 7ff8a86d3749 LeaveCriticalSection 74578 7ff8a86d3788 74576->74578 74579 7ff8a86d376a 74576->74579 74577->74576 74577->74580 74578->74570 74604 7ff8a869fff0 49 API calls 74578->74604 74579->74578 74581 7ff8a8730c00 28 API calls 74579->74581 74581->74579 74584 7ff8a86d3813 74583->74584 74585 7ff8a86d385b 74584->74585 74586 7ff8a86d3838 74584->74586 74585->74539 74605 7ff8a8731890 49 API calls 74586->74605 74588->74544 74589->74553 74592 7ff8a86d38a3 74591->74592 74593 7ff8a86d38c8 74592->74593 74595 7ff8a86d38eb 74592->74595 74606 7ff8a8731890 49 API calls 74593->74606 74595->74545 74597->74561 74598->74532 74599->74532 74601->74547 74602->74567 74603->74577 74604->74570 74605->74585 74606->74595 74608 7ff8a86d7420 181 API calls 74607->74608 74609 7ff8a86d7590 74608->74609 74610 7ff8a86d7598 74609->74610 74611 7ff8a8730f20 28 API calls 74609->74611 74610->74375 74612 7ff8a86d75c4 74611->74612 74613 7ff8a86d75e6 74612->74613 74614 7ff8a86d7641 74612->74614 74617 7ff8a8730f20 28 API calls 74613->74617 74615 7ff8a8730f20 28 API calls 74614->74615 74616 7ff8a86d7646 74615->74616 74676 7ff8a86dfff0 165 API calls 74616->74676 74619 7ff8a86d75fd 74617->74619 74619->74616 74622 7ff8a86d7620 memcpy 74619->74622 74623 7ff8a86d76bb 74619->74623 74620 7ff8a86d7691 74620->74375 74621 7ff8a86d7670 74621->74620 74677 7ff8a86dfff0 165 API calls 74621->74677 74622->74616 74626 7ff8a870ce26 74625->74626 74664 7ff8a870cfa6 74626->74664 74678 7ff8a86d6b60 74626->74678 74629 7ff8a86d6b60 175 API calls 74629->74664 74630 7ff8a86d6b60 175 API calls 74632 7ff8a870ce9d 74630->74632 74631 7ff8a870cedf 74631->74388 74633 7ff8a870cee7 74632->74633 74646 7ff8a870cea2 74632->74646 74633->74631 74637 7ff8a870cf1e strchr 74633->74637 74638 7ff8a870cf55 74633->74638 74633->74664 74634 7ff8a870d1b7 strchr 74634->74664 74641 7ff8a870cf31 74637->74641 74637->74664 74642 7ff8a870cf71 74638->74642 74643 7ff8a870cf61 74638->74643 74639 7ff8a8704170 53 API calls 74639->74664 74640 7ff8a8704370 29 API calls 74640->74664 74641->74638 74650 7ff8a870cf42 strchr 74641->74650 74690 7ff8a870c750 74642->74690 74696 7ff8a870d7e0 112 API calls 74643->74696 74646->74631 74647 7ff8a870cec8 strchr 74646->74647 74646->74664 74647->74631 74647->74664 74650->74638 74650->74664 74651 7ff8a870d595 74651->74631 74652 7ff8a870d5c3 74651->74652 74655 7ff8a870d5b6 74651->74655 74656 7ff8a870d5da 74652->74656 74662 7ff8a8730c00 28 API calls 74652->74662 74654 7ff8a87310d0 24 API calls 74654->74664 74731 7ff8a8704170 53 API calls 74655->74731 74732 7ff8a87310d0 24 API calls 74656->74732 74660 7ff8a8730c00 28 API calls 74660->74664 74662->74656 74664->74629 74664->74631 74664->74634 74664->74639 74664->74640 74664->74651 74664->74654 74664->74660 74665 7ff8a870d609 74664->74665 74671 7ff8a8730d50 TlsGetValue 74664->74671 74697 7ff8a871f9c0 29 API calls 74664->74697 74698 7ff8a8703a00 74664->74698 74707 7ff8a8720450 74664->74707 74725 7ff8a8720070 64 API calls 74664->74725 74726 7ff8a8723620 74664->74726 74730 7ff8a86b4ad0 73 API calls 74664->74730 74666 7ff8a870d76a 74665->74666 74668 7ff8a870d762 74665->74668 74733 7ff8a870ed50 105 API calls 74665->74733 74666->74388 74734 7ff8a870eae0 53 API calls 74668->74734 74671->74664 74672->74387 74673->74391 74674->74381 74675->74392 74676->74621 74677->74620 74679 7ff8a86d6b95 74678->74679 74735 7ff8a86d6cf0 74679->74735 74681 7ff8a877ae00 8 API calls 74682 7ff8a86d6ce2 74681->74682 74682->74630 74682->74633 74682->74664 74683 7ff8a86d6bb4 74684 7ff8a86d6bee 74683->74684 74747 7ff8a86b3d20 32 API calls 74683->74747 74684->74681 74686 7ff8a86d6c78 74686->74684 74688 7ff8a8730c00 28 API calls 74686->74688 74687 7ff8a86d6c5b 74687->74686 74748 7ff8a873d5e0 29 API calls 74687->74748 74688->74684 74691 7ff8a870c774 74690->74691 74693 7ff8a870c7cd 74691->74693 74749 7ff8a870ed50 105 API calls 74691->74749 74750 7ff8a870eae0 53 API calls 74691->74750 74751 7ff8a870e5d0 180 API calls 74691->74751 74696->74631 74697->74664 74699 7ff8a8703a0d TlsAlloc 74698->74699 74703 7ff8a8703a2c 74698->74703 74699->74703 74700 7ff8a8703a34 TlsGetValue 74701 7ff8a8703a49 GetLastError 74700->74701 74700->74703 74701->74703 74702 7ff8a87308b0 22 API calls 74702->74703 74703->74698 74703->74700 74703->74702 74704 7ff8a8703ae1 LeaveCriticalSection 74703->74704 74706 7ff8a8703b22 74703->74706 74705 7ff8a8703af8 GetProcessHeap HeapAlloc 74704->74705 74704->74706 74705->74703 74705->74706 74706->74664 74710 7ff8a872047a 74707->74710 74708 7ff8a872054d 74711 7ff8a8723620 56 API calls 74708->74711 74709 7ff8a87205d5 74713 7ff8a8720450 65 API calls 74709->74713 74710->74708 74710->74709 74720 7ff8a87205a6 74710->74720 74712 7ff8a8720557 74711->74712 74714 7ff8a8720576 74712->74714 74717 7ff8a8720566 74712->74717 74715 7ff8a8720608 74713->74715 74752 7ff8a8720a10 74714->74752 74715->74664 74759 7ff8a87209c0 30 API calls 74717->74759 74719 7ff8a8720574 74719->74720 74721 7ff8a87205a8 74719->74721 74722 7ff8a8720598 74719->74722 74720->74664 74723 7ff8a8720a10 57 API calls 74721->74723 74760 7ff8a87209c0 30 API calls 74722->74760 74723->74720 74725->74664 74727 7ff8a872363f 74726->74727 74728 7ff8a8723651 74726->74728 74727->74728 74761 7ff8a871f070 74727->74761 74728->74664 74730->74664 74731->74631 74732->74631 74733->74668 74734->74666 74736 7ff8a86d35a0 52 API calls 74735->74736 74737 7ff8a86d6d24 74736->74737 74738 7ff8a86d37f0 50 API calls 74737->74738 74745 7ff8a86d6d2c 74738->74745 74739 7ff8a86d6e9c 74740 7ff8a86d3880 50 API calls 74739->74740 74741 7ff8a86d6ea1 74740->74741 74741->74683 74742 7ff8a8704170 53 API calls 74742->74745 74743 7ff8a86e1760 165 API calls 74743->74745 74744 7ff8a86d6e4b strncmp 74744->74745 74745->74739 74745->74742 74745->74743 74745->74744 74746 7ff8a86d6f04 74745->74746 74747->74687 74748->74686 74749->74691 74750->74691 74753 7ff8a8720a19 74752->74753 74757 7ff8a8720ad2 74752->74757 74754 7ff8a8720af3 74753->74754 74755 7ff8a8720a95 74753->74755 74758 7ff8a871f070 56 API calls 74753->74758 74756 7ff8a8720ac0 memmove 74755->74756 74755->74757 74756->74757 74757->74719 74758->74755 74759->74719 74760->74720 74762 7ff8a871f09e 74761->74762 74763 7ff8a871f2ea 74762->74763 74764 7ff8a871f0e2 74762->74764 74767 7ff8a871f119 TlsGetValue 74762->74767 74768 7ff8a871f0fa TlsAlloc 74762->74768 74765 7ff8a871f61b TlsGetValue 74763->74765 74766 7ff8a871f5fc TlsAlloc 74763->74766 74789 7ff8a871f412 74763->74789 74764->74763 74769 7ff8a871f386 TlsGetValue 74764->74769 74770 7ff8a871f367 TlsAlloc 74764->74770 74764->74789 74778 7ff8a871f641 74765->74778 74779 7ff8a871f633 GetLastError 74765->74779 74766->74765 74766->74789 74774 7ff8a871f13f 74767->74774 74775 7ff8a871f131 GetLastError 74767->74775 74768->74767 74768->74789 74776 7ff8a871f3ac 74769->74776 74777 7ff8a871f39e GetLastError 74769->74777 74770->74769 74770->74789 74780 7ff8a87308b0 22 API calls 74774->74780 74783 7ff8a871f149 74774->74783 74775->74774 74775->74789 74781 7ff8a87308b0 22 API calls 74776->74781 74784 7ff8a871f3b6 74776->74784 74777->74776 74777->74789 74782 7ff8a87308b0 22 API calls 74778->74782 74791 7ff8a871f64b 74778->74791 74779->74778 74779->74789 74780->74783 74781->74784 74782->74791 74786 7ff8a871f203 GetProcessHeap HeapReAlloc 74783->74786 74787 7ff8a871f179 74783->74787 74783->74789 74785 7ff8a871f465 GetProcessHeap HeapReAlloc 74784->74785 74784->74789 74790 7ff8a871f3e2 74784->74790 74785->74763 74786->74764 74787->74764 74787->74789 74792 7ff8a871f1b8 memcpy 74787->74792 74788 7ff8a871f6c8 GetProcessHeap HeapReAlloc 74788->74789 74789->74728 74790->74763 74790->74789 74794 7ff8a871f4bc memcpy 74790->74794 74791->74788 74791->74789 74793 7ff8a871f70c 74791->74793 74795 7ff8a871f1d9 TlsAlloc 74792->74795 74796 7ff8a871f1f8 TlsGetValue 74792->74796 74793->74789 74797 7ff8a871f726 memcpy 74793->74797 74798 7ff8a871f4dd TlsAlloc 74794->74798 74802 7ff8a871f4fc TlsGetValue 74794->74802 74795->74789 74795->74796 74804 7ff8a871f268 74796->74804 74805 7ff8a871f25a GetLastError 74796->74805 74800 7ff8a871f766 TlsGetValue 74797->74800 74801 7ff8a871f747 TlsAlloc 74797->74801 74798->74789 74798->74802 74810 7ff8a871f78c 74800->74810 74811 7ff8a871f77e GetLastError 74800->74811 74801->74789 74801->74800 74807 7ff8a871f522 74802->74807 74808 7ff8a871f514 GetLastError 74802->74808 74809 7ff8a871f272 74804->74809 74814 7ff8a87308b0 22 API calls 74804->74814 74805->74789 74805->74804 74812 7ff8a871f52c 74807->74812 74813 7ff8a87308b0 22 API calls 74807->74813 74808->74789 74808->74807 74809->74789 74818 7ff8a871f292 GetProcessHeap HeapFree 74809->74818 74821 7ff8a871f2f9 74809->74821 74815 7ff8a871f796 74810->74815 74816 7ff8a87308b0 22 API calls 74810->74816 74811->74789 74811->74810 74812->74789 74817 7ff8a871f54c GetProcessHeap HeapFree 74812->74817 74820 7ff8a871f596 74812->74820 74813->74812 74814->74809 74815->74789 74819 7ff8a871f7b6 GetProcessHeap HeapFree 74815->74819 74822 7ff8a871f7e9 74815->74822 74816->74815 74817->74763 74818->74764 74819->74789 74820->74763 74823 7ff8a87313d0 LeaveCriticalSection 74820->74823 74821->74764 74824 7ff8a87313d0 LeaveCriticalSection 74821->74824 74822->74789 74825 7ff8a87313d0 LeaveCriticalSection 74822->74825 74823->74763 74824->74764 74825->74789 74827 7ff8a885dd21 CreateRectRgnIndirect 74826->74827 74833 7ff8a8860740 74827->74833 74830 7ff8a885ddc3 74831 7ff8a885de52 74830->74831 74832 7ff8a885de4c DeleteObject 74830->74832 74831->74395 74832->74831 74838 7ff8a8860783 74833->74838 74834 7ff8a8860840 74848 7ff8a887a220 74834->74848 74836 7ff8a88607cd strncmp 74836->74838 74837 7ff8a8860804 strncmp 74837->74838 74838->74834 74838->74836 74838->74837 74842 7ff8a8860871 74838->74842 74840 7ff8a8860961 74840->74842 74853 7ff8a88610e0 74840->74853 74841 7ff8a8860a8f 74841->74842 74845 7ff8a88610e0 69 API calls 74841->74845 74846 7ff8a8860c1a 74841->74846 74842->74830 74843 7ff8a88610e0 69 API calls 74844 7ff8a8860d5d 74843->74844 74844->74842 74874 7ff8a885b850 memset 74844->74874 74845->74846 74846->74842 74846->74843 74849 7ff8a887a240 74848->74849 74850 7ff8a887a294 74848->74850 74849->74840 74851 7ff8a887a3c6 74850->74851 74852 7ff8a887bc70 621 API calls 74850->74852 74851->74840 74852->74850 74855 7ff8a8861129 74853->74855 74856 7ff8a8861451 74853->74856 74854 7ff8a886117e GetRgnBox 74857 7ff8a88611dd 74854->74857 74858 7ff8a88611ec 7 API calls 74854->74858 74855->74854 74855->74856 74872 7ff8a86369e0 29 API calls 74855->74872 74873 7ff8a87308b0 22 API calls 74855->74873 74856->74841 74857->74858 74862 7ff8a8861293 74857->74862 74858->74862 74859 7ff8a8861172 74859->74854 74859->74856 74860 7ff8a88612f9 memset 74863 7ff8a8861310 74860->74863 74861 7ff8a88612af 74864 7ff8a88612cc 74861->74864 74865 7ff8a88612b7 memset 74861->74865 74862->74860 74862->74861 74869 7ff8a88613b4 74862->74869 74866 7ff8a8861324 memcpy 74863->74866 74863->74869 74870 7ff8a8861348 74863->74870 74864->74863 74867 7ff8a88612da memset 74864->74867 74865->74864 74866->74869 74867->74863 74868 7ff8a88649c0 27 API calls 74868->74869 74869->74856 74869->74868 74870->74869 74871 7ff8a8861390 memcpy 74870->74871 74871->74869 74871->74871 74872->74859 74873->74859 74875 7ff8a885b8c0 memset 74874->74875 74876 7ff8a885b89f 74874->74876 74877 7ff8a885b90a 74875->74877 74876->74875 74878 7ff8a885aa80 71 API calls 74877->74878 74879 7ff8a885b912 74877->74879 74878->74879 74880 7ff8a8858990 83 API calls 74879->74880 74881 7ff8a885b9d3 74880->74881 74881->74842 74882->74401 74883->74414 74884->74427 74886 7ff8a881363d 74885->74886 74887 7ff8a8813645 GetSystemMetrics 74886->74887 74888 7ff8a8813654 74886->74888 74887->74888 74889 7ff8a8813676 74888->74889 74891 7ff8a8814060 74888->74891 74889->74430 74894 7ff8a88140b6 74891->74894 74892 7ff8a881482c 74892->74889 74894->74892 74895 7ff8a88148a0 74894->74895 74896 7ff8a884ab00 DeleteObject 74895->74896 74897 7ff8a881490a 74896->74897 74899 7ff8a884ab00 DeleteObject 74897->74899 74902 7ff8a881495b 74897->74902 74898 7ff8a88149f3 74900 7ff8a884ab00 DeleteObject 74898->74900 74899->74902 74906 7ff8a8814a1f 74900->74906 74901 7ff8a88114c0 620 API calls 74903 7ff8a88149b3 74901->74903 74902->74898 74902->74901 74902->74903 74904 7ff8a884ab00 DeleteObject 74903->74904 74904->74898 74905 7ff8a8814b5a 74905->74892 74906->74905 74907 7ff8a8814cbf DeleteObject 74906->74907 74907->74905 74909 7ff8a862d9ba 74908->74909 74910 7ff8a862d843 74908->74910 74911 7ff8a862da88 74909->74911 74912 7ff8a862d9c5 74909->74912 74910->74909 74913 7ff8a862d858 74910->74913 74994 7ff8a87033a0 TlsGetValue 74911->74994 74955 7ff8a862a950 74912->74955 74989 7ff8a86dfe20 165 API calls 74913->74989 74917 7ff8a862d9d8 74934 7ff8a862d9a0 74917->74934 74981 7ff8a86a2580 74917->74981 74918 7ff8a862d868 74922 7ff8a862d88f 74918->74922 74923 7ff8a862d8c4 74918->74923 74932 7ff8a862d8bd 74918->74932 74920 7ff8a862d91c 74927 7ff8a862d92f 74920->74927 74928 7ff8a8730f20 28 API calls 74920->74928 74990 7ff8a86a1930 36 API calls 74922->74990 74926 7ff8a862d89d 74923->74926 74943 7ff8a862db49 74923->74943 74925 7ff8a862da15 74929 7ff8a862da28 74925->74929 74930 7ff8a8730f20 28 API calls 74925->74930 74926->74932 74992 7ff8a862aed0 28 API calls 74927->74992 74928->74927 74993 7ff8a86a2ec0 36 API calls 74929->74993 74930->74929 74991 7ff8a8630280 34 API calls 74932->74991 74934->74434 74935 7ff8a862d99b 74935->74934 74936 7ff8a862db15 74939 7ff8a862db3a 74936->74939 74948 7ff8a8730c00 28 API calls 74936->74948 74937 7ff8a862da94 74937->74936 74937->74943 75008 7ff8a8704170 53 API calls 74937->75008 74938 7ff8a862dc46 74938->74434 75009 7ff8a87310d0 24 API calls 74939->75009 74940 7ff8a862dc48 74947 7ff8a862dc5f 74940->74947 74952 7ff8a8730c00 28 API calls 74940->74952 74941 7ff8a862dc02 74941->74938 74941->74940 74945 7ff8a862dc3e 74941->74945 74943->74941 75010 7ff8a862dd90 238 API calls 74943->75010 75012 7ff8a8704170 53 API calls 74945->75012 75013 7ff8a87310d0 24 API calls 74947->75013 74948->74939 74950 7ff8a862dbc8 75011 7ff8a86ec690 179 API calls 74950->75011 74952->74947 74954->74437 74956 7ff8a862a967 74955->74956 74957 7ff8a862aaae 74956->74957 74958 7ff8a862a976 74956->74958 74960 7ff8a862aad4 74957->74960 74962 7ff8a862aaea 74957->74962 75017 7ff8a862ac00 165 API calls 74957->75017 74959 7ff8a8730f20 28 API calls 74958->74959 74964 7ff8a862a980 74959->74964 74960->74962 74963 7ff8a8730f20 28 API calls 74960->74963 74962->74917 74969 7ff8a862ab01 74963->74969 74965 7ff8a862aa1e 74964->74965 74967 7ff8a862aa20 74964->74967 74970 7ff8a862aa16 74964->74970 74979 7ff8a862aba0 74964->74979 74966 7ff8a862aa5d 74965->74966 74973 7ff8a8730c00 28 API calls 74965->74973 75016 7ff8a871b210 165 API calls 74966->75016 74968 7ff8a862aa37 74967->74968 74977 7ff8a8730c00 28 API calls 74967->74977 75015 7ff8a87310d0 24 API calls 74968->75015 74969->74979 75018 7ff8a871a7c0 53 API calls 74969->75018 75014 7ff8a8704170 53 API calls 74970->75014 74973->74966 74976 7ff8a862aa94 74976->74917 74977->74968 74978 7ff8a862ab69 75019 7ff8a871b210 165 API calls 74978->75019 74979->74917 74983 7ff8a86a25b9 74981->74983 74986 7ff8a86a26d8 74981->74986 74985 7ff8a86a26fe 74983->74985 74983->74986 74987 7ff8a86a2674 74983->74987 75038 7ff8a86a1930 36 API calls 74983->75038 74985->74925 74986->74985 75020 7ff8a8680040 74986->75020 74987->74985 74987->74986 75039 7ff8a8704170 53 API calls 74987->75039 74989->74918 74990->74926 74991->74920 74992->74935 74993->74934 74996 7ff8a87033c9 74994->74996 74995 7ff8a8703482 74995->74937 74997 7ff8a87033f2 74996->74997 74998 7ff8a8703406 74996->74998 75002 7ff8a8703490 74996->75002 75040 7ff8a8731890 49 API calls 74997->75040 74998->74995 75000 7ff8a8703421 74998->75000 74998->75002 75041 7ff8a869fff0 49 API calls 75000->75041 75003 7ff8a87033a0 49 API calls 75002->75003 75004 7ff8a87034e0 75003->75004 75005 7ff8a870355a 75004->75005 75006 7ff8a870351f memcpy 75004->75006 75007 7ff8a8730c00 28 API calls 75004->75007 75006->74937 75007->75006 75008->74936 75009->74943 75010->74950 75011->74941 75012->74938 75013->74938 75014->74965 75015->74965 75016->74976 75017->74960 75018->74978 75019->74962 75021 7ff8a8680096 75020->75021 75022 7ff8a87033a0 51 API calls 75021->75022 75023 7ff8a86800dc 75022->75023 75024 7ff8a8681df0 620 API calls 75023->75024 75028 7ff8a868011a 75024->75028 75025 7ff8a8683310 63 API calls 75029 7ff8a8680342 75025->75029 75026 7ff8a8680c70 53 API calls 75035 7ff8a8680248 75026->75035 75027 7ff8a86802aa 75027->75025 75027->75029 75028->75027 75030 7ff8a86801c4 75028->75030 75032 7ff8a86801c6 strncmp 75028->75032 75031 7ff8a8680c70 53 API calls 75029->75031 75030->75026 75033 7ff8a868034c 75031->75033 75032->75030 75034 7ff8a877ae00 8 API calls 75033->75034 75036 7ff8a868035d 75034->75036 75037 7ff8a8681df0 620 API calls 75035->75037 75036->74985 75037->75027 75038->74987 75039->74986 75040->74998 75041->74995 75042->74454 75043->74469 75044->73881 75045->73884 75056 7ff8a86b8b74 75046->75056 75047 7ff8a86b8cfd 75048 7ff8a86b8d2d 75047->75048 75049 7ff8a86b8d25 75047->75049 75050 7ff8a86b8d0f GetProcessHeap HeapFree 75047->75050 75048->73892 75051 7ff8a8730c00 28 API calls 75049->75051 75050->75048 75051->75048 75052 7ff8a86b8bff TlsAlloc 75052->75056 75058 7ff8a86b8d66 75052->75058 75053 7ff8a86b8c26 TlsGetValue 75054 7ff8a86b8c36 GetLastError 75053->75054 75053->75056 75054->75056 75054->75058 75055 7ff8a87308b0 22 API calls 75055->75056 75056->75047 75056->75052 75056->75053 75056->75055 75057 7ff8a86b8c73 GetProcessHeap HeapFree 75056->75057 75056->75058 75063 7ff8a87313d0 LeaveCriticalSection 75056->75063 75057->75056 75058->73892 75060->73892 75061->73888 75063->75056 75079 7ff8a873f160 75064->75079 75066 7ff8a8737475 75066->73897 75068 7ff8a87373d6 75068->75066 75069 7ff8a8730c00 28 API calls 75068->75069 75069->75066 75070 7ff8a873740c 75097 7ff8a87158e0 75070->75097 75071 7ff8a87158e0 30 API calls 75071->75068 75073 7ff8a8737423 75073->75071 75074->73917 75075->73917 75076->73922 75077->73915 75078->73921 75080 7ff8a873f1ec 75079->75080 75081 7ff8a873f18c 75079->75081 75082 7ff8a8730f20 28 API calls 75080->75082 75083 7ff8a8730f20 28 API calls 75081->75083 75084 7ff8a873f1f1 75082->75084 75087 7ff8a873f1a1 75083->75087 75115 7ff8a873f2e0 75084->75115 75086 7ff8a873f25d 75088 7ff8a873735d 75086->75088 75090 7ff8a873f289 75086->75090 75092 7ff8a873f27f 75086->75092 75087->75084 75089 7ff8a873f1c8 memcpy 75087->75089 75091 7ff8a873f2cd 75087->75091 75088->75066 75088->75068 75088->75070 75088->75073 75089->75084 75093 7ff8a873f2a0 75090->75093 75096 7ff8a8730c00 28 API calls 75090->75096 75166 7ff8a8704170 53 API calls 75092->75166 75167 7ff8a87310d0 24 API calls 75093->75167 75096->75093 75098 7ff8a87158fc 75097->75098 75099 7ff8a8715921 LeaveCriticalSection 75098->75099 75100 7ff8a8715937 75098->75100 75099->75100 75102 7ff8a871596f 75099->75102 75101 7ff8a871594c LeaveCriticalSection 75100->75101 75100->75102 75101->75102 75103 7ff8a8730c1a TlsAlloc 75102->75103 75104 7ff8a8730c39 TlsGetValue 75102->75104 75112 7ff8a87159a8 75102->75112 75103->75104 75109 7ff8a8730d1a 75103->75109 75106 7ff8a8730c56 GetLastError 75104->75106 75107 7ff8a8730c64 75104->75107 75106->75107 75106->75109 75108 7ff8a8730c6e 75107->75108 75110 7ff8a87308b0 22 API calls 75107->75110 75108->75109 75111 7ff8a8730c93 GetProcessHeap RtlDeleteBoundaryDescriptor 75108->75111 75113 7ff8a8730cb8 75108->75113 75110->75108 75111->75112 75112->75068 75113->75112 75114 7ff8a8731495 LeaveCriticalSection 75113->75114 75114->75068 75116 7ff8a873f31c 75115->75116 75117 7ff8a873f33a 75115->75117 75119 7ff8a8730f20 28 API calls 75116->75119 75118 7ff8a873f3ef 75117->75118 75168 7ff8a8704170 53 API calls 75117->75168 75118->75086 75121 7ff8a873f331 75119->75121 75121->75117 75122 7ff8a873f360 memcpy 75121->75122 75123 7ff8a873f410 75121->75123 75122->75117 75124 7ff8a873f52f 75123->75124 75126 7ff8a873f5b4 75123->75126 75130 7ff8a873f545 75123->75130 75131 7ff8a873f4af 75123->75131 75124->75130 75171 7ff8a871f9c0 29 API calls 75124->75171 75125 7ff8a873f714 75125->75086 75137 7ff8a873f86c 75126->75137 75141 7ff8a873f61a 75126->75141 75128 7ff8a873f921 75128->75125 75194 7ff8a8704170 53 API calls 75128->75194 75130->75126 75135 7ff8a873f71b 75130->75135 75150 7ff8a873f672 75130->75150 75131->75125 75169 7ff8a8722d10 165 API calls 75131->75169 75132 7ff8a873f51a 75170 7ff8a871a7c0 53 API calls 75132->75170 75175 7ff8a86369e0 75135->75175 75137->75125 75195 7ff8a873fea0 194 API calls 75137->75195 75138 7ff8a873f525 75174 7ff8a871b210 165 API calls 75138->75174 75140 7ff8a873fa3a 75140->75125 75196 7ff8a8704170 53 API calls 75140->75196 75141->75128 75191 7ff8a8722d10 165 API calls 75141->75191 75142 7ff8a873f725 memcpy 75190 7ff8a871f9c0 29 API calls 75142->75190 75146 7ff8a873f8da 75192 7ff8a871a7c0 53 API calls 75146->75192 75150->75125 75172 7ff8a8722d10 165 API calls 75150->75172 75151 7ff8a873f6e3 75173 7ff8a871a7c0 53 API calls 75151->75173 75152 7ff8a873f8e5 75193 7ff8a871b210 165 API calls 75152->75193 75154 7ff8a873f75c 75156 7ff8a8730f20 28 API calls 75154->75156 75157 7ff8a873f795 75156->75157 75157->75126 75158 7ff8a873f7c8 memcpy 75157->75158 75159 7ff8a873fa71 75157->75159 75158->75126 75160 7ff8a873fbbc strstr 75159->75160 75163 7ff8a873fb88 75159->75163 75164 7ff8a873fd0a 75159->75164 75161 7ff8a873fbd5 75160->75161 75160->75164 75162 7ff8a873fc22 memcmp 75161->75162 75161->75163 75162->75161 75162->75163 75163->75086 75164->75163 75197 7ff8a871f9c0 29 API calls 75164->75197 75166->75088 75167->75088 75168->75118 75169->75132 75170->75138 75171->75130 75172->75151 75173->75138 75174->75125 75176 7ff8a86369ed 75175->75176 75177 7ff8a86369f6 75176->75177 75178 7ff8a8636a45 __acrt_iob_func fflush 75176->75178 75177->75142 75179 7ff8a8636a6d 75178->75179 75180 7ff8a8730ac1 TlsAlloc 75179->75180 75181 7ff8a8730ae0 TlsGetValue 75180->75181 75186 7ff8a8730be4 75180->75186 75183 7ff8a8730b0b 75181->75183 75184 7ff8a8730afd GetLastError 75181->75184 75185 7ff8a8730b1a GetProcessHeap RtlAllocateHeap 75183->75185 75187 7ff8a87308b0 22 API calls 75183->75187 75184->75183 75184->75186 75189 7ff8a8730b57 75185->75189 75187->75185 75189->75142 75190->75154 75191->75146 75192->75152 75193->75128 75194->75125 75195->75140 75196->75125 75197->75163 75198->73944 75199->73945 75200->73967 75202 7ff8a8730f20 28 API calls 75201->75202 75204 7ff8a86898cf 75202->75204 75203 7ff8a8730c00 28 API calls 75203->75204 75204->75201 75204->75203 75205 7ff8a8689910 75204->75205 75205->73967 75206->73967 75209 7ff8a8689291 75207->75209 75210 7ff8a8689398 75207->75210 75208 7ff8a86892a3 75212 7ff8a86892da 75208->75212 75215 7ff8a86892a7 75208->75215 75216 7ff8a8730c00 28 API calls 75208->75216 75209->75208 75256 7ff8a8688820 165 API calls 75209->75256 75213 7ff8a86893da 75210->75213 75259 7ff8a8688820 165 API calls 75210->75259 75225 7ff8a86b88d0 621 API calls 75212->75225 75213->73967 75215->73967 75216->75212 75217 7ff8a8689352 75217->73967 75218 7ff8a86892f0 75218->75217 75219 7ff8a8689354 75218->75219 75220 7ff8a868934a 75218->75220 75221 7ff8a868936b 75219->75221 75224 7ff8a8730c00 28 API calls 75219->75224 75257 7ff8a8704170 53 API calls 75220->75257 75258 7ff8a87310d0 24 API calls 75221->75258 75224->75221 75225->75218 75231 7ff8a873cebf 75226->75231 75227 7ff8a873cf45 memcpy 75227->73958 75229 7ff8a873ceff memcpy 75229->75227 75230 7ff8a873cf37 75230->75227 75231->75226 75231->75227 75231->75229 75231->75230 75260 7ff8a8730d50 TlsGetValue 75231->75260 75234->73971 75235->73977 75236->73980 75237->73994 75238->74000 75239->74036 75241->74039 75242->74039 75244->74021 75245->73991 75246->74011 75247->74019 75248->74029 75249->74034 75250->74028 75251->74021 75252->74028 75253->74006 75254->74016 75255->74022 75256->75208 75257->75217 75258->75217 75259->75213 75610 7ff8a86a15f8 75609->75610 75611 7ff8a8730f20 28 API calls 75610->75611 75612 7ff8a86a171c 75610->75612 75613 7ff8a86a163e 75611->75613 75614 7ff8a8730f20 28 API calls 75613->75614 75615 7ff8a86a1672 75614->75615 75616 7ff8a86a16dd LeaveCriticalSection 75615->75616 75616->73595 75619 7ff8a86247d2 75617->75619 75618 7ff8a8624816 75621 7ff8a862482d GetCurrentThreadId 75618->75621 75622 7ff8a8624895 75618->75622 75619->75618 75620 7ff8a86247fd 75619->75620 75619->75622 75850 7ff8a8731890 49 API calls 75620->75850 75624 7ff8a862485c 75621->75624 75625 7ff8a862486f LeaveCriticalSection 75624->75625 75625->73599 75627 7ff8a873ce90 3 API calls 75626->75627 75628 7ff8a869a160 75627->75628 75629 7ff8a873ce90 3 API calls 75628->75629 75630 7ff8a869a170 75629->75630 75631 7ff8a873ce90 3 API calls 75630->75631 75632 7ff8a869a184 75631->75632 75633 7ff8a869a1b2 75632->75633 75634 7ff8a869a196 75632->75634 75635 7ff8a873ce90 3 API calls 75633->75635 75636 7ff8a873ce90 3 API calls 75634->75636 75637 7ff8a869a1c8 75635->75637 75641 7ff8a869a1a9 75636->75641 75851 7ff8a873a850 166 API calls 75637->75851 75639 7ff8a869a1dc 75640 7ff8a873ce90 3 API calls 75639->75640 75639->75641 75644 7ff8a869a252 memcpy 75639->75644 75645 7ff8a869a848 75639->75645 75852 7ff8a8730d50 TlsGetValue 75639->75852 75640->75639 75641->75645 75853 7ff8a8698d00 116 API calls 75641->75853 75644->75639 75859 7ff8a871a870 36 API calls 75645->75859 75646 7ff8a869a3ed 75647 7ff8a869a6c9 75646->75647 75648 7ff8a873ce90 3 API calls 75646->75648 75650 7ff8a869a6db 75647->75650 75653 7ff8a8730c00 28 API calls 75647->75653 75652 7ff8a869a414 75648->75652 75651 7ff8a869a704 75650->75651 75654 7ff8a8730c00 28 API calls 75650->75654 75655 7ff8a869a7be 75651->75655 75658 7ff8a869a74f TlsGetValue 75651->75658 75659 7ff8a869a730 TlsAlloc 75651->75659 75656 7ff8a8730f20 28 API calls 75652->75656 75653->75650 75654->75651 75657 7ff8a877ae00 8 API calls 75655->75657 75684 7ff8a869a419 75656->75684 75660 7ff8a862579f 75657->75660 75663 7ff8a869a775 75658->75663 75664 7ff8a869a767 GetLastError 75658->75664 75659->75658 75676 7ff8a869a88f 75659->75676 75660->73608 75662 7ff8a869a6b6 75857 7ff8a86992d0 167 API calls 75662->75857 75666 7ff8a869a77f 75663->75666 75667 7ff8a87308b0 22 API calls 75663->75667 75664->75663 75664->75676 75668 7ff8a869a79b 75666->75668 75666->75676 75667->75666 75670 7ff8a869a7a4 GetProcessHeap HeapFree 75668->75670 75673 7ff8a869a7eb 75668->75673 75669 7ff8a8730f20 28 API calls 75669->75684 75670->75655 75673->75655 75674 7ff8a869a496 memcpy 75674->75684 75860 7ff8a8630120 28 API calls 75676->75860 75677 7ff8a869a4f4 memcpy 75677->75684 75678 7ff8a8689270 613 API calls 75678->75684 75679 7ff8a8723620 56 API calls 75679->75684 75680 7ff8a86288a0 117 API calls 75680->75684 75681 7ff8a8720a10 57 API calls 75681->75684 75684->75645 75684->75662 75684->75669 75684->75674 75684->75676 75684->75677 75684->75678 75684->75679 75684->75680 75684->75681 75685 7ff8a873ce90 3 API calls 75684->75685 75854 7ff8a87209c0 30 API calls 75684->75854 75855 7ff8a873d260 30 API calls 75684->75855 75856 7ff8a8628020 621 API calls 75684->75856 75685->75684 75818->73611 75847->73633 75848->73640 75849->73577 75850->75618 75851->75639 75853->75646 75854->75684 75855->75684 75856->75684 75857->75647 75859->75676 75885 7ff8a88b7e70 GetWindowLongPtrW 75889 7ff8a88b7eb2 75885->75889 75890 7ff8a88b7ef6 75885->75890 75886 7ff8a88b802f DefWindowProcW 75887 7ff8a88b804f 75886->75887 75888 7ff8a88b7f50 GetSysColor 75888->75890 75889->75886 75890->75888 75890->75889 75891 7ff8a86c7630 TlsGetValue 75892 7ff8a86c7653 75891->75892 75893 7ff8a86c769f 75892->75893 75894 7ff8a86c7678 75892->75894 75897 7ff8a86c76c8 75892->75897 75900 7ff8a86c76d1 75893->75900 75904 7ff8a869fff0 49 API calls 75893->75904 75903 7ff8a8731890 49 API calls 75894->75903 75898 7ff8a87201b0 64 API calls 75897->75898 75897->75900 75901 7ff8a86c7a95 75897->75901 75905 7ff8a8720070 64 API calls 75897->75905 75898->75897 75902 7ff8a86c7ab4 memcpy 75901->75902 75902->75900 75903->75893 75904->75897 75905->75897 75906 7ff8a86d7030 75907 7ff8a86d7070 75906->75907 75917 7ff8a86d70a7 75907->75917 75918 7ff8a86cb2c0 75907->75918 75908 7ff8a877ae00 8 API calls 75909 7ff8a86d718e 75908->75909 75911 7ff8a86d70d4 75912 7ff8a86d7420 181 API calls 75911->75912 75913 7ff8a86d70f8 75912->75913 75914 7ff8a86d716b _errno 75913->75914 75915 7ff8a86d7111 75913->75915 75914->75917 75916 7ff8a86d7420 181 API calls 75915->75916 75915->75917 75916->75917 75917->75908 75919 7ff8a86cb315 75918->75919 75922 7ff8a86cb307 75918->75922 75920 7ff8a86cb34c 75919->75920 75919->75922 75921 7ff8a86cb372 75920->75921 76042 7ff8a86cc830 180 API calls 75920->76042 75931 7ff8a86cb41f 75921->75931 75937 7ff8a86cb342 75921->75937 76043 7ff8a86cc7b0 _errno 75921->76043 75922->75937 76040 7ff8a8722d10 165 API calls 75922->76040 75925 7ff8a86cb337 76041 7ff8a871a7c0 53 API calls 75925->76041 75928 7ff8a86cb3b5 75928->75931 76044 7ff8a86cd040 176 API calls 75928->76044 75930 7ff8a86cb63e 75931->75930 75933 7ff8a86cb600 75931->75933 75943 7ff8a86cb508 75931->75943 75932 7ff8a86cb3c8 75932->75931 75934 7ff8a86cb3cc 75932->75934 75933->75937 75956 7ff8a86cbb30 75933->75956 76045 7ff8a86cc7b0 _errno 75934->76045 75935 7ff8a86cb54e 75939 7ff8a86cb555 75935->75939 75946 7ff8a86cb580 75935->75946 75937->75911 76048 7ff8a86cabe0 54 API calls 75939->76048 75940 7ff8a86cb3e0 75940->75937 76046 7ff8a86cd040 176 API calls 75940->76046 75943->75935 75945 7ff8a86cb537 75943->75945 76047 7ff8a86cb790 636 API calls 75945->76047 75946->75937 75948 7ff8a86cb5c9 75946->75948 75949 7ff8a86cb5dd 75946->75949 76049 7ff8a86cb9c0 637 API calls 75946->76049 76050 7ff8a86cb790 636 API calls 75948->76050 76051 7ff8a8705fa0 39 API calls 75949->76051 75952 7ff8a86cb5e6 76052 7ff8a871a7c0 53 API calls 75952->76052 75954 7ff8a86cb5f2 76053 7ff8a86cc5d0 177 API calls 75954->76053 75957 7ff8a86cbba0 75956->75957 75984 7ff8a86cbbaa 75956->75984 75958 7ff8a8730f20 28 API calls 75957->75958 75957->75984 75958->75984 75959 7ff8a86cc008 _errno 75961 7ff8a86cc019 75959->75961 75960 7ff8a86cc112 75962 7ff8a86cc23b 75960->75962 75964 7ff8a86cc155 75960->75964 75971 7ff8a8730f20 28 API calls 75961->75971 75989 7ff8a86cc079 75961->75989 76124 7ff8a86cc5d0 177 API calls 75962->76124 76114 7ff8a8704370 29 API calls 75964->76114 75965 7ff8a86cbf62 _errno 75970 7ff8a86cbf76 75965->75970 75966 7ff8a86cc114 75969 7ff8a86cc12b 75966->75969 75980 7ff8a8730c00 28 API calls 75966->75980 75967 7ff8a86cc003 75967->75960 75967->75966 75973 7ff8a86cc10a 75967->75973 75968 7ff8a86cc243 75978 7ff8a86cc260 75968->75978 75979 7ff8a86cc250 75968->75979 76032 7ff8a86cbf2e 75968->76032 76113 7ff8a87310d0 24 API calls 75969->76113 75981 7ff8a8730f20 28 API calls 75970->75981 76004 7ff8a86cbfd3 75970->76004 75974 7ff8a86cc02f 75971->75974 76112 7ff8a8704170 53 API calls 75973->76112 75988 7ff8a86cc086 _errno 75974->75988 75974->75989 75976 7ff8a86cc15a 76115 7ff8a86cc5d0 177 API calls 75976->76115 76126 7ff8a8705fa0 39 API calls 75978->76126 76125 7ff8a871a7c0 53 API calls 75979->76125 75980->75969 75987 7ff8a86cbf88 75981->75987 75984->75959 75984->75961 75984->75965 75984->75967 75984->75970 76006 7ff8a86cbf06 75984->76006 76010 7ff8a86cc296 75984->76010 76031 7ff8a86cbedf 75984->76031 76039 7ff8a86cbebf 75984->76039 76054 7ff8a86c7e80 75984->76054 76068 7ff8a86c6270 75984->76068 76104 7ff8a86cc2c0 69 API calls 75984->76104 76105 7ff8a86cabe0 54 API calls 75984->76105 75985 7ff8a86cc167 76116 7ff8a87156e0 75985->76116 75987->75988 75987->76004 76110 7ff8a8715010 strerror 75988->76110 75989->75967 76111 7ff8a8704170 53 API calls 75989->76111 75998 7ff8a86cc26d 76127 7ff8a871a7c0 53 API calls 75998->76127 76004->75967 76109 7ff8a8704170 53 API calls 76004->76109 76012 7ff8a86cbf35 76006->76012 76013 7ff8a86cbf26 76006->76013 76006->76032 76014 7ff8a86cbf4c 76012->76014 76021 7ff8a8730c00 28 API calls 76012->76021 76107 7ff8a8704170 53 API calls 76013->76107 76108 7ff8a87310d0 24 API calls 76014->76108 76021->76014 76031->75967 76031->76039 76032->75937 76039->76006 76106 7ff8a86cabe0 54 API calls 76039->76106 76040->75925 76041->75937 76042->75921 76043->75928 76044->75932 76045->75940 76046->75937 76047->75937 76048->75937 76049->75946 76050->75937 76051->75952 76052->75954 76053->75937 76056 7ff8a86c7ea9 76054->76056 76055 7ff8a86c7eda 76061 7ff8a86c7ef9 76055->76061 76063 7ff8a86c808a 76055->76063 76066 7ff8a8730c00 28 API calls 76055->76066 76128 7ff8a86c8130 76055->76128 76056->76055 76057 7ff8a86c7ed5 76056->76057 76058 7ff8a86c7edc 76056->76058 76143 7ff8a8632780 29 API calls 76057->76143 76144 7ff8a8720070 64 API calls 76058->76144 76061->75984 76063->76061 76064 7ff8a86c80cf 76063->76064 76065 7ff8a8730c00 28 API calls 76063->76065 76064->76061 76067 7ff8a8730c00 28 API calls 76064->76067 76065->76064 76066->76055 76067->76061 76069 7ff8a86c62d7 76068->76069 76070 7ff8a86c62dc 76068->76070 76148 7ff8a86c6140 28 API calls 76069->76148 76072 7ff8a86c62fb memchr 76070->76072 76093 7ff8a86c6310 76070->76093 76072->76093 76073 7ff8a86c66f0 76074 7ff8a877ae00 8 API calls 76073->76074 76076 7ff8a86c674a 76074->76076 76075 7ff8a86c638d memcpy 76075->76093 76076->75984 76077 7ff8a8730f20 28 API calls 76094 7ff8a86c67aa 76077->76094 76078 7ff8a86c675d 76078->76077 76079 7ff8a86c66bd 76083 7ff8a86c66ca 76079->76083 76087 7ff8a8730c00 28 API calls 76079->76087 76080 7ff8a86c6823 76081 7ff8a86c687f 76080->76081 76086 7ff8a86c6859 76080->76086 76089 7ff8a86c683f 76080->76089 76081->75984 76082 7ff8a86c6608 memcpy 76082->76093 76083->76073 76088 7ff8a86c66d2 _errno 76083->76088 76084 7ff8a86c6817 76085 7ff8a873ce90 3 API calls 76084->76085 76085->76080 76090 7ff8a86c6870 76086->76090 76096 7ff8a8730c00 28 API calls 76086->76096 76087->76083 76088->76073 76149 7ff8a8704170 53 API calls 76089->76149 76150 7ff8a87310d0 24 API calls 76090->76150 76093->76073 76093->76075 76093->76078 76093->76079 76093->76082 76097 7ff8a8730c00 28 API calls 76093->76097 76099 7ff8a86c66e3 76093->76099 76100 7ff8a86c65b0 memchr 76093->76100 76094->76080 76094->76084 76098 7ff8a86c6891 76094->76098 76095 7ff8a86c6847 76095->75984 76096->76090 76097->76093 76151 7ff8a86c91f0 56 API calls 76098->76151 76099->76073 76101 7ff8a8730c00 28 API calls 76099->76101 76100->76093 76101->76073 76103 7ff8a86c68f1 76103->75984 76104->75984 76105->75984 76106->76006 76107->76032 76108->76032 76109->75967 76111->75967 76112->75960 76113->75960 76114->75976 76115->75985 76117 7ff8a87156f5 76116->76117 76120 7ff8a8715738 LeaveCriticalSection 76117->76120 76121 7ff8a8715720 76117->76121 76118 7ff8a8715783 LeaveCriticalSection 76119 7ff8a87157c2 76118->76119 76120->76121 76121->76118 76152 7ff8a8730d50 TlsGetValue 76121->76152 76124->75968 76125->76032 76126->75998 76127->76032 76129 7ff8a86c817f 76128->76129 76130 7ff8a8720450 65 API calls 76129->76130 76131 7ff8a86c8216 76130->76131 76145 7ff8a86c8740 69 API calls 76131->76145 76133 7ff8a86c83eb 76134 7ff8a86c86dc 76133->76134 76137 7ff8a86c8724 76133->76137 76138 7ff8a86c868e memcpy 76133->76138 76147 7ff8a8720070 64 API calls 76134->76147 76136 7ff8a86c870d 76136->76055 76139 7ff8a86c86b4 76138->76139 76146 7ff8a8720070 64 API calls 76139->76146 76141 7ff8a86c86c7 76142 7ff8a86c8130 113 API calls 76141->76142 76142->76134 76143->76055 76144->76055 76145->76133 76146->76141 76147->76136 76148->76070 76149->76095 76150->76081 76151->76103 76153 7ff8a87f2020 76154 7ff8a87f2061 memset SystemParametersInfoW 76153->76154 76155 7ff8a87f205d 76153->76155 76156 7ff8a87f2097 CreateFontIndirectW 76154->76156 76157 7ff8a87f21d3 SystemParametersInfoW 76154->76157 76155->76154 76182 7ff8a87f1f50 76156->76182 76158 7ff8a87f21f2 CreateFontIndirectW 76157->76158 76159 7ff8a87f2220 6 API calls 76157->76159 76163 7ff8a87f1f50 22 API calls 76158->76163 76162 7ff8a87f1f50 22 API calls 76159->76162 76161 7ff8a87f20bc DeleteObject CreateFontIndirectW 76165 7ff8a87f1f50 22 API calls 76161->76165 76166 7ff8a87f22d0 DeleteObject 76162->76166 76164 7ff8a87f2214 DeleteObject 76163->76164 76164->76159 76167 7ff8a87f20ea DeleteObject CreateFontIndirectW 76165->76167 76168 7ff8a87f2315 76166->76168 76169 7ff8a87f22e3 76166->76169 76170 7ff8a87f1f50 22 API calls 76167->76170 76169->76168 76171 7ff8a87f22f0 GetStockObject 76169->76171 76172 7ff8a87f2118 DeleteObject CreateFontIndirectW 76170->76172 76173 7ff8a87f1f50 22 API calls 76171->76173 76174 7ff8a87f1f50 22 API calls 76172->76174 76173->76169 76175 7ff8a87f2146 DeleteObject CreateFontIndirectW 76174->76175 76176 7ff8a87f1f50 22 API calls 76175->76176 76177 7ff8a87f2174 DeleteObject CreateFontIndirectW 76176->76177 76178 7ff8a87f1f50 22 API calls 76177->76178 76179 7ff8a87f219f DeleteObject CreateFontIndirectW 76178->76179 76180 7ff8a87f1f50 22 API calls 76179->76180 76181 7ff8a87f21ca DeleteObject 76180->76181 76181->76157 76183 7ff8a87f1f95 76182->76183 76188 7ff8a87f3ae0 76183->76188 76185 7ff8a87f1fdc 76199 7ff8a87f3da0 76185->76199 76187 7ff8a87f1ffb 76187->76161 76189 7ff8a87f3b20 GetDC SelectObject GetTextMetricsW GetTextFaceW 76188->76189 76191 7ff8a87f3b7c 76189->76191 76204 7ff8a87f3f80 76191->76204 76193 7ff8a87f3d35 GetCharWidthW 76195 7ff8a87f3d43 SelectObject ReleaseDC 76193->76195 76194 7ff8a87f3d3d GetCharWidthA 76194->76195 76198 7ff8a87f3d7d 76195->76198 76196 7ff8a87f3cc6 76196->76193 76196->76194 76198->76185 76200 7ff8a87f3dc0 76199->76200 76203 7ff8a87f3f35 76199->76203 76201 7ff8a87f3de0 DeleteObject 76200->76201 76200->76203 76201->76200 76202 7ff8a87f3dfc DeleteObject 76201->76202 76202->76200 76203->76187 76205 7ff8a87f3fca SelectObject GetTextFaceW 76204->76205 76206 7ff8a87f4004 76205->76206 76207 7ff8a87f4056 SelectObject 76206->76207 76208 7ff8a87f406d 76207->76208 76209 7ff8a87f4091 memset 76208->76209 76211 7ff8a87f40db 76208->76211 76212 7ff8a87f5380 SelectObject 76209->76212 76211->76196 76213 7ff8a87f53f2 76212->76213 76214 7ff8a87f53fa GetFontData 76212->76214 76213->76214 76215 7ff8a87f570a GetTextCharset 76214->76215 76222 7ff8a87f5436 76214->76222 76216 7ff8a87f5749 SelectObject 76215->76216 76219 7ff8a87f5708 76215->76219 76217 7ff8a87f5778 76216->76217 76217->76211 76218 7ff8a87f5473 GetFontData 76218->76222 76219->76216 76220 7ff8a87f553d GetFontData 76220->76222 76221 7ff8a87f55d9 GetFontData GetFontData 76221->76222 76222->76216 76222->76218 76222->76219 76222->76220 76222->76221 76223 7ff8a88b6135 76226 7ff8a88b6146 76223->76226 76224 7ff8a88b6189 76238 7ff8a87fd0c0 76224->76238 76226->76224 76227 7ff8a88b617a 76226->76227 76234 7ff8a87e68f0 76227->76234 76228 7ff8a88b6255 76230 7ff8a88b61f5 76230->76228 76242 7ff8a88050a0 memcpy 76230->76242 76231 7ff8a88b61f7 SetWindowPos 76231->76230 76235 7ff8a87e694c GetModuleHandleW 76234->76235 76236 7ff8a87e695b CreateWindowExW SetWindowPos SetWindowLongPtrW 76234->76236 76235->76236 76237 7ff8a87fcea0 76236->76237 76237->76228 76237->76230 76237->76231 76239 7ff8a87fd0de 76238->76239 76240 7ff8a87fd103 GetModuleHandleW 76239->76240 76241 7ff8a87fd112 CreateWindowExW SetWindowPos 76239->76241 76240->76241 76242->76228 76243 7ff8a861d510 TlsGetValue 76244 7ff8a861d56a 76243->76244 76245 7ff8a861d595 memset 76244->76245 76246 7ff8a861d5b4 76244->76246 76247 7ff8a861d940 76244->76247 76296 7ff8a8731890 49 API calls 76245->76296 76246->76247 76249 7ff8a861d5d8 76246->76249 76253 7ff8a861d7cc 76246->76253 76256 7ff8a861d6d0 76246->76256 76250 7ff8a877ae00 8 API calls 76249->76250 76251 7ff8a861d809 76250->76251 76252 7ff8a861d725 76254 7ff8a861d75a 76252->76254 76255 7ff8a861d896 76252->76255 76253->76249 76261 7ff8a8730c00 28 API calls 76253->76261 76297 7ff8a861f0b0 76254->76297 76280 7ff8a861d9e0 76255->76280 76256->76252 76260 7ff8a861d70b memset 76256->76260 76259 7ff8a861d770 76262 7ff8a861d8ed 76259->76262 76264 7ff8a861f0b0 28 API calls 76259->76264 76260->76252 76261->76249 76263 7ff8a861d905 76262->76263 76267 7ff8a8730c00 28 API calls 76262->76267 76265 7ff8a861d92b 76263->76265 76270 7ff8a861f2b0 28 API calls 76263->76270 76266 7ff8a861d793 76264->76266 76265->76247 76272 7ff8a8730c00 28 API calls 76265->76272 76268 7ff8a861d79f 76266->76268 76269 7ff8a861d820 76266->76269 76267->76263 76309 7ff8a861f2b0 76268->76309 76319 7ff8a861dc40 37 API calls 76269->76319 76270->76263 76272->76247 76274 7ff8a861d8d2 memcpy 76274->76262 76275 7ff8a861d7a7 76275->76262 76275->76274 76275->76275 76276 7ff8a861d833 76277 7ff8a861f2b0 28 API calls 76276->76277 76278 7ff8a861d83d 76277->76278 76279 7ff8a861f2b0 28 API calls 76278->76279 76279->76275 76281 7ff8a861f0b0 28 API calls 76280->76281 76282 7ff8a861da1c 76281->76282 76293 7ff8a861dac2 76282->76293 76320 7ff8a861edf0 76282->76320 76285 7ff8a861f2b0 28 API calls 76286 7ff8a861da72 76285->76286 76287 7ff8a861f0b0 28 API calls 76286->76287 76286->76293 76294 7ff8a861dae7 76287->76294 76288 7ff8a861db76 76289 7ff8a861f2b0 28 API calls 76288->76289 76289->76293 76290 7ff8a861edf0 37 API calls 76290->76294 76292 7ff8a861dbc0 76295 7ff8a861f2b0 28 API calls 76292->76295 76293->76275 76294->76288 76294->76290 76294->76292 76294->76293 76331 7ff8a861eb90 76294->76331 76295->76293 76296->76246 76303 7ff8a861f0fb 76297->76303 76298 7ff8a861f23e 76299 7ff8a861f24c 76298->76299 76301 7ff8a8730c00 28 API calls 76298->76301 76302 7ff8a861f25a 76299->76302 76304 7ff8a8730c00 28 API calls 76299->76304 76300 7ff8a8730c00 28 API calls 76300->76298 76301->76299 76305 7ff8a861f268 76302->76305 76307 7ff8a8730c00 28 API calls 76302->76307 76303->76298 76303->76300 76306 7ff8a861f100 76303->76306 76304->76302 76305->76306 76308 7ff8a8730c00 28 API calls 76305->76308 76306->76259 76307->76305 76308->76306 76310 7ff8a861f2bf 76309->76310 76311 7ff8a861f2f7 76309->76311 76312 7ff8a861f2cd 76310->76312 76313 7ff8a8730c00 28 API calls 76310->76313 76311->76275 76314 7ff8a861f2db 76312->76314 76315 7ff8a8730c00 28 API calls 76312->76315 76313->76312 76316 7ff8a861f2e9 76314->76316 76317 7ff8a8730c00 28 API calls 76314->76317 76315->76314 76316->76311 76318 7ff8a8730c00 28 API calls 76316->76318 76317->76316 76318->76311 76319->76276 76321 7ff8a861ee4c 76320->76321 76342 7ff8a861f470 76321->76342 76323 7ff8a861eeb2 76324 7ff8a861ef50 76323->76324 76327 7ff8a861eed8 76323->76327 76328 7ff8a861ef49 76323->76328 76330 7ff8a861da67 76323->76330 76325 7ff8a861f470 37 API calls 76324->76325 76324->76328 76324->76330 76325->76324 76326 7ff8a861f470 37 API calls 76326->76327 76327->76326 76327->76328 76327->76330 76329 7ff8a861f470 37 API calls 76328->76329 76328->76330 76329->76330 76330->76285 76332 7ff8a861ebd2 76331->76332 76333 7ff8a861f470 37 API calls 76332->76333 76334 7ff8a861ec39 76333->76334 76335 7ff8a861ecc0 76334->76335 76336 7ff8a861ecba 76334->76336 76340 7ff8a861ed63 76334->76340 76341 7ff8a861ec5c 76334->76341 76335->76336 76337 7ff8a861f470 37 API calls 76335->76337 76338 7ff8a861f470 37 API calls 76336->76338 76336->76340 76337->76335 76338->76340 76339 7ff8a861f470 37 API calls 76339->76341 76340->76294 76341->76336 76341->76339 76345 7ff8a861f812 76342->76345 76347 7ff8a861f4b9 76342->76347 76343 7ff8a861f722 76344 7ff8a861f7f1 memcmp 76343->76344 76343->76345 76344->76343 76344->76345 76345->76323 76347->76343 76347->76345 76348 7ff8a861f8f0 37 API calls 76347->76348 76348->76347 76349 7ff8a887e21f 76351 7ff8a887e19d 76349->76351 76350 7ff8a887e2b0 MoveWindow 76352 7ff8a887e2dc 76350->76352 76351->76350 76351->76352 76354 7ff8a887e30f 76352->76354 76355 7ff8a88b6050 76352->76355 76356 7ff8a88b609c 76355->76356 76357 7ff8a88b6078 76355->76357 76356->76354 76357->76356 76358 7ff8a88b6094 76357->76358 76359 7ff8a88b609e 76357->76359 76362 7ff8a87ff4d0 76358->76362 76369 7ff8a87fd260 ShowWindow 76359->76369 76363 7ff8a87ff4fd 76362->76363 76364 7ff8a87fd9b0 5 API calls 76363->76364 76366 7ff8a87ff50a 76363->76366 76364->76366 76365 7ff8a87ff513 76365->76356 76366->76365 76367 7ff8a87ff573 ShowWindow 76366->76367 76367->76365 76370 7ff8a87fd2b1 76369->76370 76370->76356 76371 7ff8a861e018 76372 7ff8a861e028 76371->76372 76373 7ff8a861e034 76371->76373 76377 7ff8a861e3a0 76372->76377 76375 7ff8a861e02d 76373->76375 76387 7ff8a861e1d0 76373->76387 76396 7ff8a861d970 76377->76396 76380 7ff8a861e55d 76380->76375 76381 7ff8a861d970 28 API calls 76382 7ff8a861e3e0 76381->76382 76382->76380 76383 7ff8a861edf0 37 API calls 76382->76383 76386 7ff8a861e41e 76383->76386 76384 7ff8a861eb90 37 API calls 76384->76386 76385 7ff8a861edf0 37 API calls 76385->76386 76386->76380 76386->76384 76386->76385 76388 7ff8a861d970 28 API calls 76387->76388 76389 7ff8a861e1f1 76388->76389 76390 7ff8a861d970 28 API calls 76389->76390 76393 7ff8a861e373 76389->76393 76391 7ff8a861e210 76390->76391 76392 7ff8a861eb90 37 API calls 76391->76392 76391->76393 76395 7ff8a861e241 76392->76395 76393->76375 76394 7ff8a861eb90 37 API calls 76394->76395 76395->76393 76395->76394 76397 7ff8a861d990 76396->76397 76399 7ff8a861d9a4 76396->76399 76398 7ff8a861f0b0 28 API calls 76397->76398 76398->76399 76399->76380 76399->76381 76400 7ff8a88b7b20 76402 7ff8a88b7b30 76400->76402 76401 7ff8a88b7c8f 76402->76401 76404 7ff8a88c8570 76402->76404 76410 7ff8a88c85aa 76404->76410 76405 7ff8a88c8a75 GetModuleHandleW 76406 7ff8a88c8a87 LoadIconW LoadIconW LoadCursorW RegisterClassExW 76405->76406 76407 7ff8a88c8b5c CreateWindowExW SetWindowLongPtrW ShowWindow UpdateWindow 76406->76407 76408 7ff8a88c8bce 76406->76408 76407->76408 76412 7ff8a88b91f0 76408->76412 76410->76405 76410->76406 76411 7ff8a88c8c22 76411->76401 76414 7ff8a88b9214 76412->76414 76413 7ff8a88b9240 76413->76411 76414->76413 76415 7ff8a88b9339 CreateBitmap CreatePatternBrush 76414->76415 76416 7ff8a88b9388 76415->76416 76416->76411 76417 7ff8a88b5060 76419 7ff8a88b508f 76417->76419 76418 7ff8a88b510d 76419->76418 76424 7ff8a87feb00 76419->76424 76421 7ff8a88b5168 76427 7ff8a880b2b0 76421->76427 76425 7ff8a87feb21 memset 76424->76425 76426 7ff8a87fec95 76425->76426 76426->76421 76428 7ff8a880b38d 76427->76428 76431 7ff8a880b2d8 76427->76431 76429 7ff8a880b72f memset 76428->76429 76430 7ff8a880b755 76429->76430 76431->76428 76432 7ff8a86b88d0 621 API calls 76431->76432 76432->76431 76433 7ff8a87e8390 76434 7ff8a87e83c0 76433->76434 76435 7ff8a87e855a DefWindowProcW 76434->76435 76436 7ff8a87e8553 76434->76436 76435->76436 76437 7ff8a86f0d00 76438 7ff8a86f0de0 76437->76438 76442 7ff8a86f0d3f 76437->76442 76452 7ff8a86ef1a0 76438->76452 76440 7ff8a86f0df1 76492 7ff8a86f04f0 29 API calls 76440->76492 76442->76438 76443 7ff8a86f0d9c 76442->76443 76489 7ff8a8722d10 165 API calls 76443->76489 76445 7ff8a86f0e09 76451 7ff8a86f0ddc 76445->76451 76493 7ff8a86f0670 29 API calls 76445->76493 76446 7ff8a86f0dab 76490 7ff8a871a7c0 53 API calls 76446->76490 76448 7ff8a86f0db6 76491 7ff8a871b210 165 API calls 76448->76491 76453 7ff8a86ef1d9 76452->76453 76454 7ff8a86ef47a 76453->76454 76456 7ff8a86ef23f 76453->76456 76494 7ff8a8611060 76453->76494 76457 7ff8a86ef668 76454->76457 76459 7ff8a86ef4eb 76454->76459 76466 7ff8a8730c00 28 API calls 76454->76466 76463 7ff8a86ef300 76456->76463 76497 7ff8a86eba90 65 API calls 76456->76497 76457->76440 76462 7ff8a86ef5e8 76459->76462 76468 7ff8a86ef512 TlsGetValue 76459->76468 76460 7ff8a86ef27a 76460->76456 76464 7ff8a8611060 __stdio_common_vsprintf 76460->76464 76503 7ff8a87310d0 24 API calls 76462->76503 76498 7ff8a8628970 116 API calls 76463->76498 76464->76460 76465 7ff8a86ef3d7 76465->76454 76471 7ff8a86ef3fc 76465->76471 76466->76459 76472 7ff8a86ef52f 76468->76472 76469 7ff8a86ef5f0 TlsGetValue 76476 7ff8a86ef60d 76469->76476 76470 7ff8a86ef56d 76488 7ff8a86ef573 76470->76488 76501 7ff8a87310d0 24 API calls 76470->76501 76499 7ff8a8628970 116 API calls 76471->76499 76472->76470 76474 7ff8a86ef558 76472->76474 76478 7ff8a86ef68d 76472->76478 76500 7ff8a8731890 49 API calls 76474->76500 76475 7ff8a86ef44e 76481 7ff8a877ae00 8 API calls 76475->76481 76477 7ff8a86ef632 76476->76477 76476->76478 76483 7ff8a86ef646 76476->76483 76504 7ff8a8731890 49 API calls 76477->76504 76478->76440 76484 7ff8a86ef46d 76481->76484 76483->76457 76485 7ff8a8730c00 28 API calls 76483->76485 76484->76440 76485->76457 76486 7ff8a86ef599 76486->76488 76502 7ff8a87310d0 24 API calls 76486->76502 76488->76469 76489->76446 76490->76448 76491->76451 76492->76445 76493->76451 76505 7ff8a8611000 76494->76505 76496 7ff8a8611086 __stdio_common_vsprintf 76496->76460 76497->76463 76498->76465 76499->76475 76500->76470 76501->76486 76502->76486 76503->76469 76504->76483 76505->76496 76506 7ff8a87f1470 76507 7ff8a87f1490 SendMessageW SendMessageW SendMessageW 76506->76507 76511 7ff8a87f1516 76506->76511 76508 7ff8a87f1509 76507->76508 76508->76511 76509 7ff8a87f15b8 76510 7ff8a87fed74 GetFocus 76512 7ff8a87fed99 GetForegroundWindow 76510->76512 76514 7ff8a87feda4 IsWindow 76510->76514 76511->76509 76511->76510 76512->76514 76515 7ff8a87ff13f SetWindowLongPtrW 76514->76515 76516 7ff8a87fedeb 76514->76516 76517 7ff8a87ff167 SetWindowLongPtrW 76515->76517 76518 7ff8a87ff17c SetParent 76515->76518 76516->76515 76517->76518 76519 7ff8a87ff192 SendMessageW SendMessageW 76518->76519 76520 7ff8a87ff26c 76518->76520 76519->76520 76521 7ff8a87ff1d0 GetDesktopWindow 76519->76521 76522 7ff8a87ff2f1 76520->76522 76523 7ff8a87ff27f SendMessageW 76520->76523 76521->76520 76524 7ff8a87ff1df SetWindowLongPtrW 76521->76524 76525 7ff8a87ff322 76522->76525 76526 7ff8a87ff2ff SetWindowPos 76522->76526 76523->76522 76527 7ff8a87ff299 SendMessageW 76523->76527 76528 7ff8a87ff258 SetMenu DestroyWindow 76524->76528 76538 7ff8a87ff1f9 76524->76538 76550 7ff8a87ff600 76525->76550 76526->76525 76531 7ff8a87ff2cf 76527->76531 76528->76520 76530 7ff8a87ff32c 76533 7ff8a87ff34e 76530->76533 76534 7ff8a87ff339 SendMessageW 76530->76534 76555 7ff8a8870d30 GetModuleHandleW RegisterClassW RegisterClassW 76531->76555 76536 7ff8a87ff371 76533->76536 76537 7ff8a87ff35b SendMessageW 76533->76537 76534->76533 76535 7ff8a87ff2d7 SendMessageW 76535->76522 76539 7ff8a87ff37d SendMessageW 76536->76539 76540 7ff8a87ff3e9 76536->76540 76537->76536 76538->76528 76545 7ff8a87ff22f SetParent 76538->76545 76542 7ff8a87ff39d 76539->76542 76541 7ff8a87ff3f5 SetMenu 76540->76541 76548 7ff8a87ff40d 76540->76548 76541->76548 76543 7ff8a87fd260 ShowWindow 76542->76543 76543->76540 76544 7ff8a87ff462 SetActiveWindow 76547 7ff8a87ff49e 76544->76547 76545->76538 76548->76544 76549 7ff8a87ff600 ShowWindow 76548->76549 76549->76548 76551 7ff8a87ff617 76550->76551 76552 7ff8a87ff625 76550->76552 76551->76530 76553 7ff8a87ff654 ShowWindow 76552->76553 76554 7ff8a87ff665 76552->76554 76553->76554 76554->76530 76555->76535 76556 7ff8a8804b30 76558 7ff8a8804b5c 76556->76558 76557 7ff8a8804bca 76558->76557 76560 7ff8a8804370 76558->76560 76561 7ff8a88043d1 AdjustWindowRectEx 76560->76561 76562 7ff8a88043a1 IsIconic 76560->76562 76566 7ff8a880444a 76561->76566 76563 7ff8a8804602 76562->76563 76564 7ff8a88043af IsZoomed 76562->76564 76563->76557 76564->76563 76565 7ff8a88043c1 76564->76565 76565->76561 76565->76563 76566->76563 76567 7ff8a880462f SendMessageW SendMessageW 76566->76567 76568 7ff8a880465e GetSystemMetrics MoveWindow GetWindowRect 76566->76568 76567->76563 76569 7ff8a8804730 76568->76569 76570 7ff8a88046be 76568->76570 76569->76563 76572 7ff8a880475d DrawMenuBar 76569->76572 76571 7ff8a88046c0 GetClientRect 76570->76571 76573 7ff8a88046f4 MoveWindow GetWindowRect 76570->76573 76574 7ff8a8804732 MoveWindow 76570->76574 76571->76569 76571->76570 76572->76563 76573->76569 76573->76571 76574->76569 76575 7ff8a8805d50 76576 7ff8a8805d61 76575->76576 76577 7ff8a8805d6b 76575->76577 76578 7ff8a88073e7 76576->76578 76579 7ff8a8807461 76576->76579 76580 7ff8a8807606 76576->76580 76581 7ff8a88073fd 76576->76581 76582 7ff8a8805de2 76577->76582 76583 7ff8a8805d9a SendMessageW 76577->76583 76578->76580 76578->76581 76586 7ff8a880743b 76578->76586 76579->76580 76579->76581 76585 7ff8a880747c 76579->76585 76581->76580 76584 7ff8a8807422 DefWindowProcW 76581->76584 76583->76582 76584->76580 76587 7ff8a88075ed DefWindowProcW 76585->76587 76588 7ff8a8807489 ImmGetContext 76585->76588 76590 7ff8a8807445 DefWindowProcW 76586->76590 76587->76580 76588->76587 76589 7ff8a880749b ImmGetCompositionStringW 76588->76589 76591 7ff8a88075dc ImmReleaseContext 76589->76591 76592 7ff8a88074b9 ImmGetCompositionStringW 76589->76592 76590->76580 76591->76580 76594 7ff8a88074ed 76592->76594 76595 7ff8a8807566 GetTickCount 76594->76595 76596 7ff8a8807580 76595->76596 76596->76591 76597 7ff8a880602f 76600 7ff8a88053c0 76597->76600 76599 7ff8a8806037 76601 7ff8a8805401 76600->76601 76602 7ff8a8805422 IsWindowVisible 76601->76602 76603 7ff8a880540a GetWindowLongPtrW 76601->76603 76605 7ff8a8805443 GetWindowPlacement 76602->76605 76608 7ff8a880543f 76602->76608 76603->76602 76604 7ff8a880552d 76603->76604 76604->76599 76605->76608 76606 7ff8a880549e 76606->76604 76607 7ff8a88054c0 GetClientRect MoveWindow 76606->76607 76607->76604 76608->76606 76609 7ff8a87fd260 ShowWindow 76608->76609 76609->76606 76610 7ff8a861e040 76611 7ff8a861e042 76610->76611 76612 7ff8a861f0b0 28 API calls 76611->76612 76613 7ff8a861eb90 37 API calls 76611->76613 76614 7ff8a861e039 76611->76614 76612->76611 76613->76611 76615 7ff8a863a5a0 76616 7ff8a863a5cc 76615->76616 76617 7ff8a863a5b3 76615->76617 76620 7ff8a8693a60 76616->76620 76619 7ff8a863a5d1 76621 7ff8a8703a00 28 API calls 76620->76621 76634 7ff8a8693a80 76621->76634 76622 7ff8a8693c05 LeaveCriticalSection 76654 7ff8a8692d10 76622->76654 76624 7ff8a8693c17 76625 7ff8a873e7f0 83 API calls 76624->76625 76626 7ff8a8693c23 76625->76626 76627 7ff8a8693c3d 76626->76627 76692 7ff8a8688820 165 API calls 76626->76692 76639 7ff8a8693ccd 76627->76639 76640 7ff8a8693cab 76627->76640 76643 7ff8a8693d75 76627->76643 76628 7ff8a8730f20 28 API calls 76628->76634 76630 7ff8a8693d3a 76695 7ff8a871a7c0 53 API calls 76630->76695 76632 7ff8a8693d45 76635 7ff8a86b8b60 36 API calls 76632->76635 76633 7ff8a8693b73 memcpy 76633->76634 76634->76622 76634->76628 76634->76633 76636 7ff8a8693bfd 76634->76636 76634->76643 76638 7ff8a8693d4e 76635->76638 76636->76622 76638->76619 76639->76630 76694 7ff8a86dfff0 165 API calls 76639->76694 76640->76639 76693 7ff8a86881b0 53 API calls 76640->76693 76645 7ff8a8693dd2 LeaveCriticalSection 76643->76645 76650 7ff8a8693db0 76643->76650 76645->76650 76646 7ff8a8693e4e LeaveCriticalSection 76648 7ff8a87795c0 76646->76648 76647 7ff8a8693dbd 76647->76619 76649 7ff8a8693e6e LeaveCriticalSection 76648->76649 76649->76619 76650->76646 76650->76647 76651 7ff8a8693e46 76650->76651 76652 7ff8a8730c00 28 API calls 76650->76652 76653 7ff8a8730c00 28 API calls 76651->76653 76652->76651 76653->76646 76655 7ff8a873e7f0 83 API calls 76654->76655 76656 7ff8a8692d2c 76655->76656 76657 7ff8a8692d5a 76656->76657 76803 7ff8a86e1760 165 API calls 76656->76803 76659 7ff8a86898c0 34 API calls 76657->76659 76678 7ff8a8692d79 76659->76678 76660 7ff8a8693070 76663 7ff8a8693084 76660->76663 76806 7ff8a8704170 53 API calls 76660->76806 76662 7ff8a8703a00 28 API calls 76662->76678 76664 7ff8a86930aa 76663->76664 76807 7ff8a8704170 53 API calls 76663->76807 76664->76624 76666 7ff8a86e1760 165 API calls 76666->76678 76669 7ff8a8704170 53 API calls 76669->76678 76670 7ff8a86b50f0 strchr strrchr strrchr 76670->76678 76671 7ff8a86930c7 76673 7ff8a869311c LeaveCriticalSection 76671->76673 76691 7ff8a869337b 76671->76691 76672 7ff8a8689270 621 API calls 76672->76678 76799 7ff8a8693eb0 76673->76799 76677 7ff8a86931be 76679 7ff8a8693eb0 LeaveCriticalSection 76677->76679 76678->76660 76678->76662 76678->76666 76678->76669 76678->76670 76678->76671 76678->76672 76696 7ff8a86d3d30 76678->76696 76736 7ff8a870c800 76678->76736 76804 7ff8a870d7e0 112 API calls 76678->76804 76805 7ff8a871f9c0 29 API calls 76678->76805 76680 7ff8a86931ef 76679->76680 76681 7ff8a8693eb0 LeaveCriticalSection 76680->76681 76682 7ff8a8693228 76681->76682 76683 7ff8a869323e memset 76682->76683 76686 7ff8a86933ad 76682->76686 76684 7ff8a869325f 76683->76684 76685 7ff8a8693268 memset 76684->76685 76684->76686 76687 7ff8a8693289 76685->76687 76687->76686 76688 7ff8a8693292 memset 76687->76688 76689 7ff8a86932e0 76688->76689 76690 7ff8a8693eb0 LeaveCriticalSection 76689->76690 76690->76691 76691->76624 76692->76627 76694->76639 76695->76632 76697 7ff8a86d3d63 76696->76697 76698 7ff8a86d3d68 76697->76698 76699 7ff8a86d3dfa 76697->76699 76700 7ff8a86d7420 181 API calls 76697->76700 76698->76678 76809 7ff8a86d5b20 204 API calls 76699->76809 76702 7ff8a86d3d88 76700->76702 76704 7ff8a86d3d8d 76702->76704 76711 7ff8a86d3de4 76702->76711 76703 7ff8a86d3e01 76705 7ff8a86d3e9d 76703->76705 76706 7ff8a86d3e0d 76703->76706 76707 7ff8a86d3d96 _errno 76704->76707 76713 7ff8a86d3da7 76704->76713 76709 7ff8a86d7420 181 API calls 76705->76709 76708 7ff8a86d3e87 76706->76708 76710 7ff8a8730f20 28 API calls 76706->76710 76722 7ff8a86d3ddf 76707->76722 76708->76678 76712 7ff8a86d3eaa 76709->76712 76718 7ff8a86d3e17 76710->76718 76711->76699 76711->76707 76714 7ff8a86d4051 76712->76714 76716 7ff8a8730f20 28 API calls 76712->76716 76713->76722 76808 7ff8a86d40c0 178 API calls 76713->76808 76714->76722 76817 7ff8a8704170 53 API calls 76714->76817 76717 7ff8a86d3ecb 76716->76717 76723 7ff8a86d4023 76717->76723 76811 7ff8a86d40c0 178 API calls 76717->76811 76719 7ff8a86d40ab 76718->76719 76810 7ff8a871a7c0 53 API calls 76718->76810 76722->76678 76723->76714 76726 7ff8a86d4053 76723->76726 76727 7ff8a86d4049 76723->76727 76725 7ff8a86d3f21 76735 7ff8a86d3f3b 76725->76735 76812 7ff8a86e1760 165 API calls 76725->76812 76728 7ff8a86d406a 76726->76728 76731 7ff8a8730c00 28 API calls 76726->76731 76815 7ff8a8704170 53 API calls 76727->76815 76816 7ff8a87310d0 24 API calls 76728->76816 76731->76728 76735->76723 76813 7ff8a871f9c0 29 API calls 76735->76813 76814 7ff8a86dfff0 165 API calls 76735->76814 76737 7ff8a870c990 76736->76737 76738 7ff8a870c830 76736->76738 76739 7ff8a870c999 76737->76739 76740 7ff8a870c9a6 76737->76740 76738->76737 76744 7ff8a870c84a 76738->76744 76745 7ff8a870c934 76738->76745 76821 7ff8a870cc60 38 API calls 76739->76821 76742 7ff8a870c9fc 76740->76742 76743 7ff8a870c9ac 76740->76743 76824 7ff8a86d68f0 184 API calls 76742->76824 76822 7ff8a86b50f0 strchr strrchr strrchr 76743->76822 76749 7ff8a870c8d0 76744->76749 76750 7ff8a870c853 76744->76750 76748 7ff8a870c94d strchr 76745->76748 76747 7ff8a870c88b 76747->76678 76748->76737 76754 7ff8a870c963 76748->76754 76752 7ff8a870c8e9 strchr 76749->76752 76751 7ff8a870c8c2 76750->76751 76761 7ff8a870c858 76750->76761 76820 7ff8a870cc60 38 API calls 76751->76820 76752->76737 76756 7ff8a870c903 76752->76756 76754->76737 76754->76747 76758 7ff8a870c970 strchr 76754->76758 76755 7ff8a870caa0 76759 7ff8a870cb28 76755->76759 76760 7ff8a870caaf 76755->76760 76756->76737 76756->76747 76764 7ff8a870c914 strchr 76756->76764 76758->76737 76758->76747 76765 7ff8a870cb2d 76759->76765 76766 7ff8a870cb40 76759->76766 76763 7ff8a870cb1b 76760->76763 76768 7ff8a870caca 76760->76768 76775 7ff8a870c750 180 API calls 76760->76775 76761->76747 76818 7ff8a86b50f0 strchr strrchr strrchr 76761->76818 76771 7ff8a8703a00 28 API calls 76763->76771 76764->76737 76764->76747 76829 7ff8a870cd30 180 API calls 76765->76829 76770 7ff8a870cb94 76766->76770 76773 7ff8a870c750 180 API calls 76766->76773 76767 7ff8a870c9cc 76767->76747 76823 7ff8a871f9c0 29 API calls 76767->76823 76780 7ff8a870caf4 76768->76780 76828 7ff8a86e1760 165 API calls 76768->76828 76774 7ff8a8730f20 28 API calls 76770->76774 76771->76780 76772 7ff8a870ca09 76772->76755 76777 7ff8a870ca5d 76772->76777 76782 7ff8a870ca53 76772->76782 76786 7ff8a870ca5b 76772->76786 76779 7ff8a870cb51 76773->76779 76774->76780 76781 7ff8a870cac5 76775->76781 76778 7ff8a870ca74 76777->76778 76789 7ff8a8730c00 28 API calls 76777->76789 76826 7ff8a87310d0 24 API calls 76778->76826 76779->76770 76784 7ff8a870cb56 76779->76784 76780->76747 76792 7ff8a870cbfd 76780->76792 76793 7ff8a870cbf3 76780->76793 76781->76763 76781->76768 76825 7ff8a8704170 53 API calls 76782->76825 76784->76780 76830 7ff8a86e1760 165 API calls 76784->76830 76785 7ff8a870c886 76785->76747 76819 7ff8a870d7e0 112 API calls 76785->76819 76786->76747 76827 7ff8a86d68f0 184 API calls 76786->76827 76789->76778 76794 7ff8a870cc14 76792->76794 76798 7ff8a8730c00 28 API calls 76792->76798 76831 7ff8a8704170 53 API calls 76793->76831 76832 7ff8a87310d0 24 API calls 76794->76832 76798->76794 76801 7ff8a8693ed3 76799->76801 76800 7ff8a8693fd5 76801->76800 76801->76801 76802 7ff8a8693f61 LeaveCriticalSection 76801->76802 76802->76677 76803->76657 76804->76678 76805->76678 76806->76663 76807->76664 76808->76722 76809->76703 76810->76708 76811->76725 76812->76735 76813->76735 76814->76735 76815->76714 76816->76714 76817->76722 76818->76785 76819->76747 76820->76747 76821->76747 76822->76767 76823->76747 76824->76772 76825->76786 76826->76786 76827->76755 76828->76780 76829->76780 76830->76780 76831->76747 76832->76747 76833 7ff8a884a8c0 76834 7ff8a884a8d6 76833->76834 76835 7ff8a88b6050 7 API calls 76834->76835 76836 7ff8a884a914 76834->76836 76835->76836 76837 7ff8a8764b10 GetFileType 76838 7ff8a8764b39 76837->76838 76839 7ff8a8764b47 GetConsoleMode 76837->76839 76840 7ff8a8764b3d GetLastError 76838->76840 76841 7ff8a8764b59 76838->76841 76839->76841 76842 7ff8a8764b60 GetCommState 76839->76842 76840->76839 76840->76841 76843 7ff8a877ae00 8 API calls 76841->76843 76842->76841 76844 7ff8a8764b8f 76843->76844 76845 7ff8a8779e90 76846 7ff8a8779ea1 76845->76846 76849 7ff8a8779fe1 76845->76849 76847 7ff8a8779edb EnterCriticalSection 76846->76847 76848 7ff8a8779eaa InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 76846->76848 76850 7ff8a8779ef5 QueryPerformanceFrequency 76847->76850 76851 7ff8a8779fd4 LeaveCriticalSection 76847->76851 76848->76847 76852 7ff8a877a00b QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection 76849->76852 76853 7ff8a877a04f 76849->76853 76854 7ff8a8779fca 76850->76854 76855 7ff8a8779f24 7 API calls 76850->76855 76851->76849 76852->76853 76854->76851 76856 7ff8a869fef0 30 API calls 76855->76856 76856->76854

                                                                            Executed Functions

                                                                            Function 00007FF8A8624C27 Relevance: 127.9, APIs: 15, Strings: 57, Instructions: 1899threadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LeaveCriticalSection.KERNEL32 ref: 00007FF8A8624CA0
                                                                              • Part of subcall function 00007FF8A8730F20: TlsAlloc.KERNEL32 ref: 00007FF8A8730F2D
                                                                              • Part of subcall function 00007FF8A8730F20: TlsGetValue.KERNEL32 ref: 00007FF8A8730F5B
                                                                              • Part of subcall function 00007FF8A8730F20: GetLastError.KERNEL32 ref: 00007FF8A8730F69
                                                                              • Part of subcall function 00007FF8A8730F20: LeaveCriticalSection.KERNEL32 ref: 00007FF8A873100B
                                                                              • Part of subcall function 00007FF8A8730F20: GetProcessHeap.KERNEL32 ref: 00007FF8A873101F
                                                                              • Part of subcall function 00007FF8A8730F20: HeapAlloc.KERNEL32 ref: 00007FF8A8731030
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            • _wgetenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FF8A8625257
                                                                              • Part of subcall function 00007FF8A8703A00: TlsAlloc.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703A0D
                                                                              • Part of subcall function 00007FF8A8703A00: TlsGetValue.KERNEL32 ref: 00007FF8A8703A3B
                                                                              • Part of subcall function 00007FF8A8703A00: GetLastError.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703A49
                                                                              • Part of subcall function 00007FF8A8703A00: LeaveCriticalSection.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703AEB
                                                                              • Part of subcall function 00007FF8A8703A00: GetProcessHeap.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703AFF
                                                                              • Part of subcall function 00007FF8A8703A00: HeapAlloc.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703B10
                                                                            • GetCurrentThreadId.KERNEL32 ref: 00007FF8A8625310
                                                                            • _wgetenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FF8A8625326
                                                                            • LeaveCriticalSection.KERNEL32 ref: 00007FF8A8625563
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Heap$Alloc$CriticalLeaveSection$ErrorLastProcessValue$_wgetenv$AllocateCurrentThread
                                                                            • String ID: 1.1.0$1.2.11$2.0.1$8.6.12$::tcl$::tcl::Bgerror$::tcl::mathfunc$::tcl::mathop$::tcl::prefix$::tcl::unsupported$::tcl::unsupported::assemble$::tcl::unsupported::corotype$::tcl::unsupported::disassemble$::tcl::unsupported::getbytecode$::tcl::unsupported::representation$::tcl::unsupported::timerate$Can't create math function namespace$INNER$TCL_INTERP_DEBUG_FRAME$TCL_PKG_PREFER_LATEST$Tcl$TclOO$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$array$athop::$binary$binary decode$binary encode$builtin command with NULL object command proc and a NULL compile proc$can't create math operator namespace$cp1252$dian$dict$encoding$engine$failed to create math operator %s$file$form$hLevel$info$iso8859-1$namespace$namespace eval ::tcl::zlib {variable cmdcounter 0}$package ifneeded TclOO 1.1.0 {# Already present, OK?};namespace eval ::oo { variable version 1.1.0 };namespace eval ::oo { variable patchlevel 1.1.0 };$prefix$set$string$tcl$tcl::tommath$tcl_precision$threaded$unable to alloc %u bytes$wordSize$zlib$zlibVersion$%
                                                                            • API String ID: 146455483-2957008561
                                                                            • Opcode ID: a9ef3b43f9938996ccbdece675dac748e3c1f0f81a6b49dd510cee4832ca0b8f
                                                                            • Instruction ID: 1e871bf7500995381bc191520da78e1dd00ccbc5700badd56bb4d2d4b7d02079
                                                                            • Opcode Fuzzy Hash: a9ef3b43f9938996ccbdece675dac748e3c1f0f81a6b49dd510cee4832ca0b8f
                                                                            • Instruction Fuzzy Hash: 7C239F76A0AB82A5EB50DF20E8443A937A4FB44BC8F149135DE4D077A5EF3CE554C368
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88C8570 Relevance: 56.4, APIs: 9, Strings: 23, Instructions: 375windowregistryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Load$Icon$ClassCreateCursorHandleLongModuleRegisterShowUpdate
                                                                            • String ID: 8.6$8.6.12$::ttk$::ttk::style$Button.border$P$Ttk$arrow$classic$default$downarrow$from$highlight$hsash$image$label$leftarrow$rightarrow$style$text$ttk::theme::classic$uparrow$vsash
                                                                            • API String ID: 3723784198-449331163
                                                                            • Opcode ID: 8f9ba403931917c369828b063368510c2b79a1c9ad4c486de7b4d73ff0a393d7
                                                                            • Instruction ID: fbb2036c70d569ccecf1506528dddeda26d173856c3a0895761c474268ee4125
                                                                            • Opcode Fuzzy Hash: 8f9ba403931917c369828b063368510c2b79a1c9ad4c486de7b4d73ff0a393d7
                                                                            • Instruction Fuzzy Hash: CA129975A0AB46A2EB549F21E8482E973A1FF48BC6F444136DE4D07B24DF3CE155C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8625C21 Relevance: 49.0, APIs: 4, Strings: 28, Instructions: 974stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strstr
                                                                            • String ID: 1.1.0$1.2.11$2.0.1$8.6.12$::tcl::mathfunc$::tcl::mathop$::tcl::unsupported$::tcl::unsupported::corotype$::tcl::unsupported::timerate$Tcl$TclOO$athop::$cp1252$dian$engine$form$hLevel$iso8859-1$namespace eval ::tcl::zlib {variable cmdcounter 0}$package ifneeded TclOO 1.1.0 {# Already present, OK?};namespace eval ::oo { variable version 1.1.0 };namespace eval ::oo { variable patchlevel 1.1.0 };$set$tcl$tcl::tommath$tcl_precision$threaded$wordSize$zlib$zlibVersion
                                                                            • API String ID: 1392478783-3286498808
                                                                            • Opcode ID: ad9f037b3b99fd8d0c37a8b64c89b86d9f785c9a7723fd5541fb287ac8929a76
                                                                            • Instruction ID: 49c448d71930c4b2d31bc490743ec55528eef02391ddcf67dd52c9fa7400513f
                                                                            • Opcode Fuzzy Hash: ad9f037b3b99fd8d0c37a8b64c89b86d9f785c9a7723fd5541fb287ac8929a76
                                                                            • Instruction Fuzzy Hash: 44A2AC76A0AB82A6FB608F11E4446B977A4FB58BD8F049035DA8D07791EF3CE154C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F1470 Relevance: 47.6, APIs: 25, Strings: 2, Instructions: 333windowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1502 7ff8a87f1470-7ff8a87f148a 1503 7ff8a87f1516-7ff8a87f151e 1502->1503 1504 7ff8a87f1490-7ff8a87f1507 SendMessageW * 3 1502->1504 1507 7ff8a87f1562-7ff8a87f1569 1503->1507 1508 7ff8a87f1520-7ff8a87f152e 1503->1508 1505 7ff8a87f150c-7ff8a87f1511 1504->1505 1506 7ff8a87f1509 1504->1506 1505->1503 1506->1505 1509 7ff8a87f156b-7ff8a87f1579 1507->1509 1510 7ff8a87f15b8-7ff8a87f15bd 1507->1510 1508->1507 1511 7ff8a87f1530-7ff8a87f153f 1508->1511 1509->1510 1512 7ff8a87f157b-7ff8a87f158a 1509->1512 1513 7ff8a87f1541 1511->1513 1514 7ff8a87f154b-7ff8a87f1552 1511->1514 1515 7ff8a87f1596-7ff8a87f159d 1512->1515 1516 7ff8a87f158c 1512->1516 1513->1514 1514->1507 1517 7ff8a87f1554-7ff8a87f1558 1514->1517 1515->1510 1519 7ff8a87f159f-7ff8a87f15a9 1515->1519 1516->1515 1517->1507 1518 7ff8a87f155a-7ff8a87f155d call 7ff8a87fecf0 1517->1518 1518->1507 1519->1510 1521 7ff8a87f15ab-7ff8a87fed66 1519->1521 1524 7ff8a87fed74-7ff8a87fed97 GetFocus 1521->1524 1525 7ff8a87fed68-7ff8a87fed70 call 7ff8a88b6110 1521->1525 1526 7ff8a87feda4 1524->1526 1527 7ff8a87fed99-7ff8a87feda2 GetForegroundWindow 1524->1527 1525->1524 1529 7ff8a87fedac-7ff8a87fedc6 1526->1529 1527->1526 1527->1529 1532 7ff8a87feddd-7ff8a87fede5 IsWindow 1529->1532 1533 7ff8a87fedc8-7ff8a87fedd9 1529->1533 1534 7ff8a87ff13f-7ff8a87ff165 SetWindowLongPtrW 1532->1534 1535 7ff8a87fedeb-7ff8a87fedfc 1532->1535 1533->1532 1537 7ff8a87ff167-7ff8a87ff176 SetWindowLongPtrW 1534->1537 1538 7ff8a87ff17c-7ff8a87ff18c SetParent 1534->1538 1535->1534 1537->1538 1540 7ff8a87ff192-7ff8a87ff1ca SendMessageW * 2 1538->1540 1541 7ff8a87ff26c-7ff8a87ff27d 1538->1541 1540->1541 1542 7ff8a87ff1d0-7ff8a87ff1d9 GetDesktopWindow 1540->1542 1543 7ff8a87ff2f1-7ff8a87ff2fd 1541->1543 1544 7ff8a87ff27f-7ff8a87ff297 SendMessageW 1541->1544 1542->1541 1545 7ff8a87ff1df-7ff8a87ff1f7 SetWindowLongPtrW 1542->1545 1546 7ff8a87ff322-7ff8a87ff337 call 7ff8a87ff600 1543->1546 1547 7ff8a87ff2ff-7ff8a87ff31c SetWindowPos 1543->1547 1544->1543 1548 7ff8a87ff299-7ff8a87ff2eb SendMessageW call 7ff8a8870d30 SendMessageW 1544->1548 1549 7ff8a87ff1f9-7ff8a87ff21b 1545->1549 1550 7ff8a87ff258-7ff8a87ff266 SetMenu DestroyWindow 1545->1550 1556 7ff8a87ff34e-7ff8a87ff359 1546->1556 1557 7ff8a87ff339-7ff8a87ff348 SendMessageW 1546->1557 1547->1546 1548->1543 1549->1550 1559 7ff8a87ff21d 1549->1559 1550->1541 1560 7ff8a87ff371-7ff8a87ff37b 1556->1560 1561 7ff8a87ff35b-7ff8a87ff36b SendMessageW 1556->1561 1557->1556 1562 7ff8a87ff220-7ff8a87ff224 1559->1562 1563 7ff8a87ff37d-7ff8a87ff39b SendMessageW 1560->1563 1564 7ff8a87ff3e9-7ff8a87ff3f3 1560->1564 1561->1560 1567 7ff8a87ff226-7ff8a87ff22d 1562->1567 1568 7ff8a87ff24c-7ff8a87ff256 1562->1568 1569 7ff8a87ff3dd-7ff8a87ff3e4 call 7ff8a87fd260 1563->1569 1570 7ff8a87ff39d-7ff8a87ff3d6 1563->1570 1565 7ff8a87ff3f5-7ff8a87ff406 SetMenu 1564->1565 1566 7ff8a87ff40d-7ff8a87ff410 1564->1566 1565->1566 1572 7ff8a87ff412-7ff8a87ff418 1566->1572 1573 7ff8a87ff46f-7ff8a87ff486 SetActiveWindow 1566->1573 1567->1568 1574 7ff8a87ff22f-7ff8a87ff246 SetParent 1567->1574 1568->1550 1568->1562 1569->1564 1570->1569 1577 7ff8a87ff462-7ff8a87ff469 1572->1577 1578 7ff8a87ff41a-7ff8a87ff428 1572->1578 1580 7ff8a87ff49e-7ff8a87ff4ce call 7ff8a88df7a0 1573->1580 1574->1568 1577->1573 1578->1577 1581 7ff8a87ff42a-7ff8a87ff42d 1578->1581 1583 7ff8a87ff430-7ff8a87ff434 1581->1583 1585 7ff8a87ff456-7ff8a87ff460 1583->1585 1586 7ff8a87ff436-7ff8a87ff43d 1583->1586 1585->1577 1585->1583 1586->1585 1587 7ff8a87ff43f-7ff8a87ff452 call 7ff8a87fecf0 call 7ff8a87ff600 1586->1587 1587->1585
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSendWindow$FocusForegroundLong
                                                                            • String ID: UpdateWrapper: Cannot find container window$UpdateWrapper: Container was destroyed
                                                                            • API String ID: 2937761121-1156326135
                                                                            • Opcode ID: d434dc067906118a4d60ed8c6fdb3e4352b40dac76156baa84dc3e4e8265a215
                                                                            • Instruction ID: 965d07c6e3a963a46a1fad044e9547c23a92f99ef0dc66ac089f70b6f3c06c0a
                                                                            • Opcode Fuzzy Hash: d434dc067906118a4d60ed8c6fdb3e4352b40dac76156baa84dc3e4e8265a215
                                                                            • Instruction Fuzzy Hash: B9F19D36B0AA8692EB64CF22E4447A973A0FB84BD5F084135CE5E07794DF7CE855C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A869A0C0 Relevance: 42.6, APIs: 8, Strings: 16, Instructions: 569memoryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1592 7ff8a869a0c0-7ff8a869a18e call 7ff8a873ce90 * 3 1599 7ff8a869a190-7ff8a869a194 1592->1599 1600 7ff8a869a1b2-7ff8a869a1de call 7ff8a873ce90 call 7ff8a873a850 1592->1600 1599->1600 1601 7ff8a869a196-7ff8a869a1ad call 7ff8a873ce90 1599->1601 1610 7ff8a869a1e4-7ff8a869a1ef 1600->1610 1611 7ff8a869a859-7ff8a869a868 call 7ff8a8708bd0 1600->1611 1607 7ff8a869a308-7ff8a869a340 call 7ff8a86e9310 1601->1607 1613 7ff8a869a345-7ff8a869a34d 1607->1613 1614 7ff8a869a1f5-7ff8a869a206 1610->1614 1615 7ff8a869a36b-7ff8a869a375 1610->1615 1621 7ff8a869a869-7ff8a869a877 call 7ff8a8708bd0 1611->1621 1617 7ff8a869a353-7ff8a869a356 1613->1617 1618 7ff8a869a848-7ff8a869a858 call 7ff8a8708bd0 1613->1618 1620 7ff8a869a210-7ff8a869a223 1614->1620 1619 7ff8a869a303 1615->1619 1622 7ff8a869a386-7ff8a869a38c 1617->1622 1623 7ff8a869a358-7ff8a869a35c 1617->1623 1618->1611 1619->1607 1625 7ff8a869a229-7ff8a869a239 1620->1625 1626 7ff8a869a2ab 1620->1626 1645 7ff8a869a878-7ff8a869a886 call 7ff8a8708bd0 1621->1645 1632 7ff8a869a398-7ff8a869a3f8 call 7ff8a86e9310 call 7ff8a8698d00 1622->1632 1633 7ff8a869a38e-7ff8a869a395 1622->1633 1630 7ff8a869a377-7ff8a869a382 1623->1630 1631 7ff8a869a35e-7ff8a869a369 1623->1631 1627 7ff8a869a268-7ff8a869a270 1625->1627 1628 7ff8a869a23b-7ff8a869a248 call 7ff8a8730ab0 1625->1628 1635 7ff8a869a2af-7ff8a869a2ec call 7ff8a873ce90 1626->1635 1639 7ff8a869a272-7ff8a869a27c 1627->1639 1640 7ff8a869a284-7ff8a869a291 call 7ff8a8730d50 1627->1640 1650 7ff8a869a252-7ff8a869a266 memcpy 1628->1650 1651 7ff8a869a24a-7ff8a869a24c 1628->1651 1630->1622 1631->1622 1658 7ff8a869a6c9-7ff8a869a6d4 1632->1658 1659 7ff8a869a3fe-7ff8a869a43e call 7ff8a873ce90 call 7ff8a8730f20 1632->1659 1633->1632 1635->1620 1649 7ff8a869a2f2-7ff8a869a2fe 1635->1649 1639->1640 1646 7ff8a869a27e-7ff8a869a281 1639->1646 1656 7ff8a869a293-7ff8a869a295 1640->1656 1657 7ff8a869a29b-7ff8a869a2a1 1640->1657 1660 7ff8a869a887-7ff8a869a8a6 call 7ff8a871a870 call 7ff8a8704460 call 7ff8a8708bd0 1645->1660 1646->1640 1649->1619 1650->1635 1651->1621 1651->1650 1656->1645 1656->1657 1657->1635 1661 7ff8a869a2a3-7ff8a869a2a9 1657->1661 1664 7ff8a869a6d6 call 7ff8a8730c00 1658->1664 1665 7ff8a869a6db-7ff8a869a6fd 1658->1665 1685 7ff8a869a444-7ff8a869a44c 1659->1685 1686 7ff8a869a6b6-7ff8a869a6c4 call 7ff8a86992d0 1659->1686 1699 7ff8a869a8a7-7ff8a869a8b5 call 7ff8a8708bd0 1660->1699 1661->1635 1664->1665 1666 7ff8a869a704-7ff8a869a721 1665->1666 1667 7ff8a869a6ff call 7ff8a8730c00 1665->1667 1672 7ff8a869a727-7ff8a869a72e 1666->1672 1673 7ff8a869a7be-7ff8a869a7ea call 7ff8a877ae00 1666->1673 1667->1666 1677 7ff8a869a751 1672->1677 1678 7ff8a869a730-7ff8a869a749 TlsAlloc 1672->1678 1684 7ff8a869a757-7ff8a869a765 TlsGetValue 1677->1684 1682 7ff8a869a8fd-7ff8a869a909 call 7ff8a8708bd0 1678->1682 1683 7ff8a869a74f 1678->1683 1695 7ff8a869a90a-7ff8a869a916 call 7ff8a8708bd0 1682->1695 1683->1684 1688 7ff8a869a775-7ff8a869a778 1684->1688 1689 7ff8a869a767-7ff8a869a76f GetLastError 1684->1689 1690 7ff8a869a450 1685->1690 1686->1658 1697 7ff8a869a782-7ff8a869a78c 1688->1697 1698 7ff8a869a77a-7ff8a869a77f call 7ff8a87308b0 1688->1698 1689->1688 1689->1695 1696 7ff8a869a457-7ff8a869a45e 1690->1696 1705 7ff8a869a917-7ff8a869a955 call 7ff8a8708bd0 call 7ff8a8630120 1695->1705 1696->1696 1702 7ff8a869a460-7ff8a869a46c call 7ff8a8730f20 1696->1702 1704 7ff8a869a792-7ff8a869a795 1697->1704 1697->1705 1698->1697 1714 7ff8a869a8b6-7ff8a869a8c4 call 7ff8a8708bd0 1699->1714 1721 7ff8a869a47f-7ff8a869a48c call 7ff8a8730ab0 1702->1721 1722 7ff8a869a46e-7ff8a869a47d 1702->1722 1704->1705 1706 7ff8a869a79b-7ff8a869a7a2 1704->1706 1712 7ff8a869a7a4-7ff8a869a7b8 GetProcessHeap HeapFree 1706->1712 1713 7ff8a869a7eb-7ff8a869a80b 1706->1713 1712->1673 1718 7ff8a869a811-7ff8a869a822 1713->1718 1719 7ff8a869a80d 1713->1719 1729 7ff8a869a8c5-7ff8a869a8d8 call 7ff8a8708bd0 1714->1729 1718->1673 1725 7ff8a869a824-7ff8a869a834 1718->1725 1719->1718 1732 7ff8a869a496-7ff8a869a4b1 memcpy 1721->1732 1733 7ff8a869a48e-7ff8a869a490 1721->1733 1727 7ff8a869a4b5-7ff8a869a4cc call 7ff8a8730f20 1722->1727 1725->1673 1731 7ff8a869a836-7ff8a869a843 call 7ff8a87313d0 1725->1731 1738 7ff8a869a4de-7ff8a869a4ea call 7ff8a8730ab0 1727->1738 1739 7ff8a869a4ce-7ff8a869a4dc 1727->1739 1741 7ff8a869a8d9-7ff8a869a8ec call 7ff8a8708bd0 1729->1741 1731->1673 1732->1727 1733->1699 1733->1732 1749 7ff8a869a4f4-7ff8a869a517 memcpy 1738->1749 1750 7ff8a869a4ec-7ff8a869a4ee 1738->1750 1742 7ff8a869a51a-7ff8a869a524 1739->1742 1754 7ff8a869a8ed-7ff8a869a8fc call 7ff8a8708bd0 1741->1754 1746 7ff8a869a526-7ff8a869a52d 1742->1746 1747 7ff8a869a57d-7ff8a869a599 call 7ff8a8689270 1742->1747 1752 7ff8a869a530-7ff8a869a537 1746->1752 1758 7ff8a869a5a5-7ff8a869a5af 1747->1758 1759 7ff8a869a59b-7ff8a869a59f 1747->1759 1749->1742 1750->1714 1750->1749 1752->1752 1753 7ff8a869a539-7ff8a869a53b 1752->1753 1753->1747 1756 7ff8a869a53d-7ff8a869a540 1753->1756 1754->1682 1756->1729 1762 7ff8a869a546-7ff8a869a558 call 7ff8a8723620 1756->1762 1760 7ff8a869a5b1-7ff8a869a5b4 1758->1760 1761 7ff8a869a622-7ff8a869a629 1758->1761 1759->1758 1764 7ff8a869a692 1759->1764 1760->1761 1765 7ff8a869a5b6-7ff8a869a5be 1760->1765 1768 7ff8a869a668-7ff8a869a684 call 7ff8a86288a0 1761->1768 1769 7ff8a869a62b-7ff8a869a636 1761->1769 1776 7ff8a869a55a-7ff8a869a55d 1762->1776 1777 7ff8a869a56f-7ff8a869a578 call 7ff8a8720a10 1762->1777 1767 7ff8a869a697-7ff8a869a6ad 1764->1767 1765->1761 1770 7ff8a869a5c0-7ff8a869a61a call 7ff8a86288a0 call 7ff8a873d260 call 7ff8a873ce90 call 7ff8a8628020 1765->1770 1767->1686 1773 7ff8a869a6af-7ff8a869a6b1 1767->1773 1782 7ff8a869a688-7ff8a869a690 1768->1782 1769->1754 1774 7ff8a869a63c-7ff8a869a648 1769->1774 1770->1660 1795 7ff8a869a620 1770->1795 1773->1690 1774->1741 1784 7ff8a869a64e-7ff8a869a654 1774->1784 1776->1777 1781 7ff8a869a55f-7ff8a869a56d call 7ff8a87209c0 1776->1781 1777->1747 1781->1747 1782->1767 1784->1741 1787 7ff8a869a65a-7ff8a869a65e 1784->1787 1787->1741 1790 7ff8a869a664 1787->1790 1790->1768 1795->1782
                                                                            APIs
                                                                              • Part of subcall function 00007FF8A873CE90: memcpy.VCRUNTIME140 ref: 00007FF8A873CF09
                                                                              • Part of subcall function 00007FF8A873CE90: memcpy.VCRUNTIME140 ref: 00007FF8A873CF52
                                                                            • memcpy.VCRUNTIME140 ref: 00007FF8A869A4A6
                                                                            • memcpy.VCRUNTIME140 ref: 00007FF8A869A503
                                                                              • Part of subcall function 00007FF8A8720A10: memmove.VCRUNTIME140(00000000,00000000,00000000,00007FF8A872083A,?,?,00000000,00007FF8A8680F76,?,?,?,?,?,00007FF8A8683B51), ref: 00007FF8A8720ACD
                                                                            • TlsAlloc.KERNEL32 ref: 00007FF8A869A730
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A869A759
                                                                            • GetLastError.KERNEL32 ref: 00007FF8A869A767
                                                                            • memcpy.VCRUNTIME140 ref: 00007FF8A869A25D
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            • GetProcessHeap.KERNEL32 ref: 00007FF8A869A7AA
                                                                            • HeapFree.KERNEL32 ref: 00007FF8A869A7B8
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memcpy$Heap$AllocErrorLastProcessValue$AllocateFreememmove
                                                                            • String ID: %s called with shared object$:$:$::tcl$Tcl_AppendLimitedToObj$TlsGetValue failed from TclpGetAllocCache$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$___tmp$alloc: invalid block: %p: %x %x$could not allocate thread local storage$invalid ensemble name '%s'$tcl:$unable to alloc %u bytes$unable to find or create %s namespace!$unable to realloc %u bytes
                                                                            • API String ID: 3659358637-3962243352
                                                                            • Opcode ID: 16ea12354320b2f055e8a09979d4e429d40056e01089ecdddc7bbe4fba802513
                                                                            • Instruction ID: de36657160e35c4a3e4d4601ee1ee065fe60a2e5359c8ce111dfe6d49f53d0bc
                                                                            • Opcode Fuzzy Hash: 16ea12354320b2f055e8a09979d4e429d40056e01089ecdddc7bbe4fba802513
                                                                            • Instruction Fuzzy Hash: 6342AE72A0AB42AAFB50CF25E4442AD77A1FB48BD8F145136DA4D47B99EF3CE401C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88028B0 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 342stringwindowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1965 7ff8a88028b0-7ff8a88028f4 1966 7ff8a88028f6-7ff8a8802913 1965->1966 1967 7ff8a8802918-7ff8a8802935 strcmp 1965->1967 1970 7ff8a8802e30-7ff8a8802e4c call 7ff8a88df7a0 1966->1970 1971 7ff8a8802937-7ff8a880293b 1967->1971 1972 7ff8a8802946-7ff8a8802978 1967->1972 1971->1972 1974 7ff8a880293d-7ff8a8802944 1971->1974 1975 7ff8a88029ff-7ff8a8802a25 1972->1975 1976 7ff8a880297e 1972->1976 1974->1966 1980 7ff8a8802b36-7ff8a8802b3b 1975->1980 1981 7ff8a8802a2b-7ff8a8802a43 memset 1975->1981 1978 7ff8a8802981-7ff8a88029b5 call 7ff8a88b6d90 1976->1978 1994 7ff8a8802acc-7ff8a8802b2d 1978->1994 1995 7ff8a88029bb-7ff8a88029c3 1978->1995 1983 7ff8a8802e20-7ff8a8802e28 1980->1983 1984 7ff8a8802a49-7ff8a8802a58 1981->1984 1985 7ff8a8802cb8-7ff8a8802cdf call 7ff8a87fdb90 1981->1985 1983->1970 1988 7ff8a8802a60-7ff8a8802a98 call 7ff8a88b6d90 1984->1988 1996 7ff8a8802ce4-7ff8a8802ce6 1985->1996 2007 7ff8a8802b40-7ff8a8802b42 1988->2007 2008 7ff8a8802a9e-7ff8a8802aa6 1988->2008 1994->1980 1995->1994 1998 7ff8a88029c9-7ff8a88029d3 1995->1998 1999 7ff8a8802e1e 1996->1999 2000 7ff8a8802cec-7ff8a8802cf6 call 7ff8a87fe100 1996->2000 1998->1994 2002 7ff8a88029d9-7ff8a88029e3 1998->2002 1999->1983 2000->1983 2002->1994 2006 7ff8a88029e9-7ff8a88029ec 2002->2006 2006->1994 2009 7ff8a88029f2-7ff8a88029fa 2006->2009 2011 7ff8a8802b44-7ff8a8802ba8 CreateDIBSection 2007->2011 2008->2007 2012 7ff8a8802aac-7ff8a8802ab6 2008->2012 2009->1978 2013 7ff8a88029fc 2009->2013 2014 7ff8a8802da0-7ff8a8802ddf 2011->2014 2015 7ff8a8802bae-7ff8a8802bc4 2011->2015 2012->2007 2016 7ff8a8802abc-7ff8a8802ac6 2012->2016 2013->1975 2036 7ff8a8802de6-7ff8a8802e1c 2014->2036 2018 7ff8a8802bc6-7ff8a8802bcd 2015->2018 2019 7ff8a8802c1c-7ff8a8802c45 CreateDIBSection 2015->2019 2016->2007 2020 7ff8a8802ac8-7ff8a8802aca 2016->2020 2022 7ff8a8802bd0-7ff8a8802c1a 2018->2022 2023 7ff8a8802c4b-7ff8a8802c89 memset CreateIconIndirect DeleteObject * 2 2019->2023 2024 7ff8a8802d4a-7ff8a8802d9e DeleteObject 2019->2024 2020->2011 2022->2019 2022->2022 2025 7ff8a8802cfb-7ff8a8802d45 2023->2025 2026 7ff8a8802c8b-7ff8a8802cb2 2023->2026 2024->2036 2025->2036 2026->1985 2026->1988 2036->1983
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CreateDeleteObject$Sectionmemset$IconIndirectstrcmp
                                                                            • String ID: -default$ICON$ICONPHOTO$IMAGE$MASK$PHOTO$can't use "%s" as iconphoto: not a photo image$failed to create an iconphoto with image "%s"$failed to create icon for "%s"$failed to create mask bitmap for "%s"$window ?-default? image1 ?image2 ...?
                                                                            • API String ID: 1159928025-2276822187
                                                                            • Opcode ID: a33a0aeaa4059e254456a7a31dd376ebe9ed76bb71453a393a00ea0f0b3845b2
                                                                            • Instruction ID: 1f3caa4fefe2bc6abda34d82e95b5c687caea66fc462fa2de19134ab4e8efce7
                                                                            • Opcode Fuzzy Hash: a33a0aeaa4059e254456a7a31dd376ebe9ed76bb71453a393a00ea0f0b3845b2
                                                                            • Instruction Fuzzy Hash: BAF16726B0AA4696EB10CF66E4542AD33B1FB88BC9F084176CE0E57754DF7CE419C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A876BF30 Relevance: 34.0, APIs: 6, Strings: 13, Instructions: 765libraryloaderCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 2040 7ff8a876bf30-7ff8a876bf81 call 7ff8a873e7f0 call 7ff8a8730f20 call 7ff8a8730ab0 2047 7ff8a876cabb-7ff8a876cacc call 7ff8a8708bd0 2040->2047 2048 7ff8a876bf87-7ff8a876bfdf call 7ff8a8741250 2040->2048 2053 7ff8a876cacd-7ff8a876cade call 7ff8a8708bd0 2047->2053 2054 7ff8a876bfe9-7ff8a876bff0 2048->2054 2055 7ff8a876bfe1-7ff8a876bfe4 call 7ff8a8704170 2048->2055 2065 7ff8a876cadf-7ff8a876caf0 call 7ff8a8708bd0 2053->2065 2058 7ff8a876c042-7ff8a876c068 GetSystemInfo call 7ff8a8730f20 call 7ff8a8730ab0 2054->2058 2059 7ff8a876bff2-7ff8a876c01c GetModuleHandleW GetProcAddress 2054->2059 2055->2054 2058->2053 2073 7ff8a876c06e-7ff8a876c0ba call 7ff8a8730f20 call 7ff8a8730ab0 2058->2073 2062 7ff8a876c01e-7ff8a876c029 2059->2062 2063 7ff8a876c02b-7ff8a876c032 GetVersionExW 2059->2063 2062->2063 2064 7ff8a876c038 2062->2064 2063->2064 2064->2058 2072 7ff8a876caf1-7ff8a876cb02 call 7ff8a8708bd0 2065->2072 2078 7ff8a876cb03-7ff8a876cb11 call 7ff8a8708bd0 2072->2078 2083 7ff8a876caa9-7ff8a876caba call 7ff8a8708bd0 2073->2083 2084 7ff8a876c0c0-7ff8a876c106 call 7ff8a8730f20 call 7ff8a8730ab0 2073->2084 2086 7ff8a876cb12-7ff8a876cb23 call 7ff8a8708bd0 2078->2086 2083->2047 2096 7ff8a876cb6c-7ff8a876cb7f call 7ff8a8708bd0 2084->2096 2097 7ff8a876c10c-7ff8a876c155 call 7ff8a8741250 2084->2097 2093 7ff8a876cb24-7ff8a876cb35 call 7ff8a8708bd0 2086->2093 2101 7ff8a876cb36-7ff8a876cb47 call 7ff8a8708bd0 2093->2101 2105 7ff8a876c15f-7ff8a876c169 2097->2105 2106 7ff8a876c157-7ff8a876c15a call 7ff8a8704170 2097->2106 2111 7ff8a876cb48-7ff8a876cb59 call 7ff8a8708bd0 2101->2111 2109 7ff8a876c16b-7ff8a876c16e call 7ff8a8704170 2105->2109 2110 7ff8a876c173-7ff8a876c176 2105->2110 2106->2105 2109->2110 2113 7ff8a876c178-7ff8a876c17c 2110->2113 2114 7ff8a876c186-7ff8a876c1a1 call 7ff8a8730f20 call 7ff8a8730ab0 2110->2114 2122 7ff8a876cb5a-7ff8a876cb6b call 7ff8a8708bd0 2111->2122 2113->2114 2117 7ff8a876c17e-7ff8a876c181 call 7ff8a8704460 2113->2117 2114->2065 2125 7ff8a876c1a7-7ff8a876c1ed call 7ff8a8730f20 call 7ff8a8730ab0 2114->2125 2117->2114 2122->2096 2125->2083 2131 7ff8a876c1f3-7ff8a876c23c call 7ff8a8730f20 call 7ff8a8730ab0 2125->2131 2131->2072 2136 7ff8a876c242-7ff8a876c28b call 7ff8a8741250 2131->2136 2139 7ff8a876c28d-7ff8a876c290 call 7ff8a8704170 2136->2139 2140 7ff8a876c295-7ff8a876c29f 2136->2140 2139->2140 2142 7ff8a876c2a9-7ff8a876c2ac 2140->2142 2143 7ff8a876c2a1-7ff8a876c2a4 call 7ff8a8704170 2140->2143 2145 7ff8a876c2ae-7ff8a876c2b2 2142->2145 2146 7ff8a876c2bc-7ff8a876c2ee wsprintfA 2142->2146 2143->2142 2145->2146 2147 7ff8a876c2b4-7ff8a876c2b7 call 7ff8a8704460 2145->2147 2148 7ff8a876c2f0-7ff8a876c2f7 2146->2148 2147->2146 2148->2148 2150 7ff8a876c2f9-7ff8a876c306 call 7ff8a8730f20 2148->2150 2153 7ff8a876c318-7ff8a876c325 call 7ff8a8730ab0 2150->2153 2154 7ff8a876c308-7ff8a876c316 2150->2154 2159 7ff8a876c32f-7ff8a876c34d memcpy 2153->2159 2160 7ff8a876c327-7ff8a876c329 2153->2160 2155 7ff8a876c351-7ff8a876c370 call 7ff8a8730f20 call 7ff8a8730ab0 2154->2155 2155->2083 2164 7ff8a876c376-7ff8a876c3bc call 7ff8a8730f20 call 7ff8a8730ab0 2155->2164 2159->2155 2160->2078 2160->2159 2164->2122 2169 7ff8a876c3c2-7ff8a876c417 call 7ff8a8741250 2164->2169 2172 7ff8a876c419-7ff8a876c41c call 7ff8a8704170 2169->2172 2173 7ff8a876c421-7ff8a876c42b 2169->2173 2172->2173 2175 7ff8a876c42d-7ff8a876c430 call 7ff8a8704170 2173->2175 2176 7ff8a876c435-7ff8a876c438 2173->2176 2175->2176 2178 7ff8a876c43a-7ff8a876c43e 2176->2178 2179 7ff8a876c448-7ff8a876c450 2176->2179 2178->2179 2180 7ff8a876c440-7ff8a876c443 call 7ff8a8704460 2178->2180 2181 7ff8a876c47e-7ff8a876c4b2 call 7ff8a8730f20 call 7ff8a8730ab0 2179->2181 2182 7ff8a876c452-7ff8a876c479 call 7ff8a8740f80 2179->2182 2180->2179 2181->2111 2189 7ff8a876c4b8-7ff8a876c4fb call 7ff8a8730f20 call 7ff8a8730ab0 2181->2189 2182->2181 2189->2101 2194 7ff8a876c501-7ff8a876c543 call 7ff8a8740800 2189->2194 2197 7ff8a876c54d-7ff8a876c557 2194->2197 2198 7ff8a876c545-7ff8a876c548 call 7ff8a8704170 2194->2198 2200 7ff8a876c559-7ff8a876c55c call 7ff8a8704170 2197->2200 2201 7ff8a876c561-7ff8a876c564 2197->2201 2198->2197 2200->2201 2202 7ff8a876c566-7ff8a876c56a 2201->2202 2203 7ff8a876c581-7ff8a876c599 call 7ff8a8730f20 call 7ff8a8730ab0 2201->2203 2205 7ff8a876c8d4-7ff8a876c917 call 7ff8a876be40 call 7ff8a8740f80 2202->2205 2206 7ff8a876c570-7ff8a876c57b call 7ff8a8704460 2202->2206 2203->2111 2217 7ff8a876c59f-7ff8a876c5e2 call 7ff8a8730f20 call 7ff8a8730ab0 2203->2217 2218 7ff8a876c91e-7ff8a876c955 call 7ff8a8730f20 call 7ff8a8730ab0 2205->2218 2219 7ff8a876c919 call 7ff8a8730c00 2205->2219 2206->2203 2206->2205 2217->2122 2229 7ff8a876c5e8-7ff8a876c638 call 7ff8a8740800 2217->2229 2218->2086 2231 7ff8a876c95b-7ff8a876c993 call 7ff8a8730f20 call 7ff8a8730ab0 2218->2231 2219->2218 2234 7ff8a876c63a-7ff8a876c63d call 7ff8a8704170 2229->2234 2235 7ff8a876c642-7ff8a876c64c 2229->2235 2231->2083 2245 7ff8a876c999-7ff8a876c9e2 call 7ff8a8730f20 call 7ff8a8730ab0 2231->2245 2234->2235 2238 7ff8a876c64e-7ff8a876c651 call 7ff8a8704170 2235->2238 2239 7ff8a876c656-7ff8a876c659 2235->2239 2238->2239 2243 7ff8a876c65b-7ff8a876c662 2239->2243 2244 7ff8a876c684-7ff8a876c69c call 7ff8a8730f20 call 7ff8a8730ab0 2239->2244 2246 7ff8a876c664-7ff8a876c66f call 7ff8a8704460 2243->2246 2247 7ff8a876c671-7ff8a876c67f call 7ff8a873ce90 2243->2247 2244->2111 2258 7ff8a876c6a2-7ff8a876c6e5 call 7ff8a8730f20 call 7ff8a8730ab0 2244->2258 2245->2093 2261 7ff8a876c9e8-7ff8a876ca49 call 7ff8a8741250 2245->2261 2246->2244 2246->2247 2247->2244 2258->2096 2272 7ff8a876c6eb-7ff8a876c72f call 7ff8a8740800 2258->2272 2267 7ff8a876ca4b-7ff8a876ca4e call 7ff8a8704170 2261->2267 2268 7ff8a876ca53-7ff8a876ca60 2261->2268 2267->2268 2270 7ff8a876ca6a-7ff8a876ca6d 2268->2270 2271 7ff8a876ca62-7ff8a876ca65 call 7ff8a8704170 2268->2271 2274 7ff8a876ca6f-7ff8a876ca73 2270->2274 2275 7ff8a876ca7d-7ff8a876caa8 call 7ff8a877ae00 2270->2275 2271->2270 2282 7ff8a876c739-7ff8a876c743 2272->2282 2283 7ff8a876c731-7ff8a876c734 call 7ff8a8704170 2272->2283 2274->2275 2277 7ff8a876ca75-7ff8a876ca78 call 7ff8a8704460 2274->2277 2277->2275 2285 7ff8a876c74d-7ff8a876c750 2282->2285 2286 7ff8a876c745-7ff8a876c748 call 7ff8a8704170 2282->2286 2283->2282 2287 7ff8a876c77b-7ff8a876c780 2285->2287 2288 7ff8a876c752-7ff8a876c759 2285->2288 2286->2285 2292 7ff8a876c7aa-7ff8a876c7c2 call 7ff8a8730f20 call 7ff8a8730ab0 2287->2292 2293 7ff8a876c782-7ff8a876c7a5 call 7ff8a8740f80 2287->2293 2290 7ff8a876c75b-7ff8a876c766 call 7ff8a8704460 2288->2290 2291 7ff8a876c768-7ff8a876c776 call 7ff8a873ce90 2288->2291 2290->2287 2290->2291 2291->2287 2292->2111 2303 7ff8a876c7c8-7ff8a876c80b call 7ff8a8730f20 call 7ff8a8730ab0 2292->2303 2293->2205 2303->2111 2308 7ff8a876c811-7ff8a876c856 call 7ff8a8730f20 call 7ff8a8730ab0 2303->2308 2308->2101 2313 7ff8a876c85c-7ff8a876c8a3 call 7ff8a8741250 2308->2313 2316 7ff8a876c8ad-7ff8a876c8b7 2313->2316 2317 7ff8a876c8a5-7ff8a876c8a8 call 7ff8a8704170 2313->2317 2318 7ff8a876c8b9-7ff8a876c8bc call 7ff8a8704170 2316->2318 2319 7ff8a876c8c1-7ff8a876c8c4 2316->2319 2317->2316 2318->2319 2319->2205 2322 7ff8a876c8c6-7ff8a876c8ca 2319->2322 2322->2205 2323 7ff8a876c8cc-7ff8a876c8cf call 7ff8a8704460 2322->2323 2323->2205
                                                                            APIs
                                                                              • Part of subcall function 00007FF8A8730F20: TlsAlloc.KERNEL32 ref: 00007FF8A8730F2D
                                                                              • Part of subcall function 00007FF8A8730F20: TlsGetValue.KERNEL32 ref: 00007FF8A8730F5B
                                                                              • Part of subcall function 00007FF8A8730F20: GetLastError.KERNEL32 ref: 00007FF8A8730F69
                                                                              • Part of subcall function 00007FF8A8730F20: LeaveCriticalSection.KERNEL32 ref: 00007FF8A873100B
                                                                              • Part of subcall function 00007FF8A8730F20: GetProcessHeap.KERNEL32 ref: 00007FF8A873101F
                                                                              • Part of subcall function 00007FF8A8730F20: HeapAlloc.KERNEL32 ref: 00007FF8A8731030
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            • GetModuleHandleW.KERNEL32 ref: 00007FF8A876BFF9
                                                                            • GetProcAddress.KERNEL32 ref: 00007FF8A876C009
                                                                            • GetVersionExW.KERNEL32 ref: 00007FF8A876C032
                                                                            • wsprintfA.USER32 ref: 00007FF8A876C2D9
                                                                            • memcpy.VCRUNTIME140 ref: 00007FF8A876C344
                                                                            • GetSystemInfo.KERNEL32 ref: 00007FF8A876C047
                                                                              • Part of subcall function 00007FF8A8704170: TlsGetValue.KERNEL32 ref: 00007FF8A87041CD
                                                                              • Part of subcall function 00007FF8A8704170: TlsGetValue.KERNEL32 ref: 00007FF8A87042A9
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: HeapValue$Alloc$ErrorLastProcess$AddressAllocateCriticalHandleInfoLeaveModuleProcSectionSystemVersionmemcpywsprintf
                                                                            • String ID: %d.%d$HOME$HOMEPATH$NTDLL$RtlGetVersion$env$machine$platform$rator$tcl_platform$unable to alloc %u bytes$user$windows
                                                                            • API String ID: 3163286187-3862273396
                                                                            • Opcode ID: 584631115b1181c45d609841968ac1cce70f9e5a216e6c86aed0065c562637a2
                                                                            • Instruction ID: 0e051442c08eab5cf7933f183ccc64eb0ea1316aaa6cc484ec704d48e1dc948e
                                                                            • Opcode Fuzzy Hash: 584631115b1181c45d609841968ac1cce70f9e5a216e6c86aed0065c562637a2
                                                                            • Instruction Fuzzy Hash: 96728C32A4A782AAEB05DF21E4502797BA0FB84BC4F088135DB4D47796DF3CE951C768
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8779E90 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 122threadsynchronizationCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CriticalSection$Initialize$Create$EnterEventLeavePerformanceQueryThread$CloseCounterFrequencyHandleObjectPrioritySingleWait
                                                                            • String ID: gfffffff
                                                                            • API String ID: 1584168963-1523873471
                                                                            • Opcode ID: adc0f5351e5d77d2adf13962fef3e8524e85feb7c124935a7597a8cd33b13f5f
                                                                            • Instruction ID: 7066d2368e74db1b97f87512068427216911736181bd4736cff6b8fcfc3e8fc5
                                                                            • Opcode Fuzzy Hash: adc0f5351e5d77d2adf13962fef3e8524e85feb7c124935a7597a8cd33b13f5f
                                                                            • Instruction Fuzzy Hash: C6514CB1E8BA42A2EB04DB25F85476573A1FB887C5F844135CA0E83674DF3DE488C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B91F0 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 153windowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Create$BitmapBrushPattern
                                                                            • String ID: 8.6$Button.border$Combobox.focus$Scrollbar.trough$Ttk$alt$border$client$field$focus$slider$thumb$ttk::theme::winnative$winnative
                                                                            • API String ID: 3280665104-2094136981
                                                                            • Opcode ID: b31de2be146e75256c0e82ad79fddffdc6f373d01e20bd9515acc9596ba2253f
                                                                            • Instruction ID: 04bdd20b3d687a9aa2e869fe2a6a0834166cbec489107861077c4a573fe1f7d5
                                                                            • Opcode Fuzzy Hash: b31de2be146e75256c0e82ad79fddffdc6f373d01e20bd9515acc9596ba2253f
                                                                            • Instruction Fuzzy Hash: 95717D75A0AB5AA2EB54DB61E8081E973A0FB48BC5F884136DD4D07B55EF3CE104C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8860740 Relevance: 24.5, APIs: 2, Strings: 14, Instructions: 503stringCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 2513 7ff8a8860740-7ff8a886078f 2515 7ff8a8860848-7ff8a8860857 2513->2515 2516 7ff8a8860795-7ff8a886079a 2513->2516 2517 7ff8a886085d-7ff8a8860864 2515->2517 2518 7ff8a886090e 2515->2518 2519 7ff8a88607a0-7ff8a88607c0 2516->2519 2520 7ff8a886086a-7ff8a886086c 2517->2520 2521 7ff8a8860910-7ff8a8860917 2517->2521 2518->2521 2526 7ff8a886082e-7ff8a886083a 2519->2526 2527 7ff8a88607c2-7ff8a88607c5 2519->2527 2520->2521 2522 7ff8a886091c-7ff8a886096d call 7ff8a88b6d90 call 7ff8a887a220 2521->2522 2523 7ff8a8860919 2521->2523 2538 7ff8a886096f 2522->2538 2539 7ff8a88609c0-7ff8a88609ca 2522->2539 2523->2522 2526->2519 2528 7ff8a8860840 2526->2528 2527->2526 2530 7ff8a88607c7-7ff8a88607cb 2527->2530 2528->2515 2532 7ff8a88607cd-7ff8a88607e2 strncmp 2530->2532 2533 7ff8a88607fb-7ff8a8860802 2530->2533 2532->2533 2536 7ff8a88607e4-7ff8a88607ea 2532->2536 2533->2526 2534 7ff8a8860804-7ff8a8860816 strncmp 2533->2534 2534->2526 2537 7ff8a8860818-7ff8a886081e 2534->2537 2540 7ff8a8860871-7ff8a8860880 2536->2540 2541 7ff8a88607f0-7ff8a88607f9 2536->2541 2543 7ff8a8860824 2537->2543 2544 7ff8a88608f3-7ff8a8860909 2537->2544 2545 7ff8a8860972-7ff8a8860975 2538->2545 2551 7ff8a88609cc-7ff8a88609cf 2539->2551 2552 7ff8a88609e3-7ff8a88609eb 2539->2552 2553 7ff8a8860887-7ff8a88608ee 2540->2553 2542 7ff8a8860828-7ff8a886082a 2541->2542 2542->2526 2543->2542 2544->2553 2548 7ff8a8860977-7ff8a8860981 2545->2548 2549 7ff8a8860993-7ff8a8860996 2545->2549 2548->2549 2554 7ff8a8860983-7ff8a886098a 2548->2554 2557 7ff8a8860998-7ff8a88609a4 2549->2557 2558 7ff8a88609b6-7ff8a88609bb 2549->2558 2551->2552 2559 7ff8a88609d1-7ff8a88609db 2551->2559 2555 7ff8a88609ed-7ff8a8860a07 2552->2555 2556 7ff8a8860a35-7ff8a8860a38 2552->2556 2567 7ff8a8860f33-7ff8a8860f4d 2553->2567 2554->2549 2570 7ff8a8860a0d 2555->2570 2571 7ff8a8860a09-7ff8a8860a0b 2555->2571 2562 7ff8a8860a3a-7ff8a8860a4f 2556->2562 2563 7ff8a8860a80-7ff8a8860a91 call 7ff8a88610e0 2556->2563 2557->2558 2560 7ff8a88609a6-7ff8a88609ad 2557->2560 2561 7ff8a8860f2b 2558->2561 2559->2552 2560->2558 2561->2567 2574 7ff8a8860a57 2562->2574 2575 7ff8a8860a51-7ff8a8860a55 2562->2575 2577 7ff8a8860ade-7ff8a8860ae5 2563->2577 2578 7ff8a8860a93-7ff8a8860ad9 2563->2578 2576 7ff8a8860a0f-7ff8a8860a16 2570->2576 2571->2576 2579 7ff8a8860a5a-7ff8a8860a61 2574->2579 2575->2579 2583 7ff8a8860a18-7ff8a8860a22 2576->2583 2584 7ff8a8860a31 2576->2584 2581 7ff8a8860aeb-7ff8a8860aee 2577->2581 2582 7ff8a8860ce7 2577->2582 2578->2545 2586 7ff8a8860a7c 2579->2586 2587 7ff8a8860a63-7ff8a8860a6d 2579->2587 2588 7ff8a8860afa-7ff8a8860b16 2581->2588 2589 7ff8a8860af0-7ff8a8860af4 2581->2589 2585 7ff8a8860cea-7ff8a8860ced 2582->2585 2583->2584 2590 7ff8a8860a24 2583->2590 2584->2556 2592 7ff8a8860df5-7ff8a8860dfd 2585->2592 2593 7ff8a8860cf3-7ff8a8860cfa 2585->2593 2586->2563 2587->2586 2594 7ff8a8860a6f 2587->2594 2602 7ff8a8860b18-7ff8a8860b71 2588->2602 2603 7ff8a8860b76-7ff8a8860b90 2588->2603 2589->2588 2589->2592 2590->2584 2597 7ff8a8860e0d-7ff8a8860e16 2592->2597 2598 7ff8a8860dff-7ff8a8860e09 2592->2598 2593->2592 2595 7ff8a8860d00-7ff8a8860d03 2593->2595 2594->2586 2600 7ff8a8860d0f-7ff8a8860d43 call 7ff8a8861830 2595->2600 2601 7ff8a8860d05-7ff8a8860d09 2595->2601 2604 7ff8a8860e18 2597->2604 2605 7ff8a8860e25 2597->2605 2598->2597 2600->2545 2619 7ff8a8860d49-7ff8a8860d5f call 7ff8a88610e0 2600->2619 2601->2592 2601->2600 2602->2545 2603->2545 2616 7ff8a8860b96-7ff8a8860bba 2603->2616 2604->2605 2608 7ff8a8860e1a-7ff8a8860e23 2604->2608 2609 7ff8a8860e29-7ff8a8860e30 2605->2609 2608->2605 2608->2609 2613 7ff8a8860e43-7ff8a8860e5b 2609->2613 2614 7ff8a8860e32-7ff8a8860e41 call 7ff8a8863c40 2609->2614 2617 7ff8a8860e5d 2613->2617 2618 7ff8a8860e85-7ff8a8860e8c 2613->2618 2614->2613 2633 7ff8a8860cd0-7ff8a8860ce2 2616->2633 2634 7ff8a8860bc0-7ff8a8860c00 call 7ff8a8861480 2616->2634 2621 7ff8a8860e60-7ff8a8860e83 2617->2621 2622 7ff8a8860e8e-7ff8a8860e98 2618->2622 2623 7ff8a8860eaa-7ff8a8860ead 2618->2623 2619->2578 2636 7ff8a8860d65-7ff8a8860d71 2619->2636 2621->2618 2622->2623 2627 7ff8a8860e9a-7ff8a8860ea1 2622->2627 2629 7ff8a8860ecd-7ff8a8860efd 2623->2629 2630 7ff8a8860eaf-7ff8a8860ebb 2623->2630 2627->2623 2631 7ff8a8860eff-7ff8a8860f06 2629->2631 2632 7ff8a8860f29 2629->2632 2630->2629 2637 7ff8a8860ebd-7ff8a8860ec4 2630->2637 2631->2632 2639 7ff8a8860f08 2631->2639 2632->2561 2633->2545 2634->2633 2652 7ff8a8860c06-7ff8a8860c1c call 7ff8a88610e0 2634->2652 2641 7ff8a8860d9e-7ff8a8860dd6 call 7ff8a885b850 2636->2641 2642 7ff8a8860d73-7ff8a8860d76 2636->2642 2637->2629 2643 7ff8a8860f10-7ff8a8860f18 2639->2643 2651 7ff8a8860dd9-7ff8a8860ddb 2641->2651 2645 7ff8a8860d78-7ff8a8860d88 2642->2645 2646 7ff8a8860d8b-7ff8a8860d9b 2642->2646 2649 7ff8a8860f1a-7ff8a8860f21 2643->2649 2650 7ff8a8860f25 2643->2650 2645->2646 2646->2641 2649->2643 2655 7ff8a8860f23 2649->2655 2650->2632 2651->2545 2654 7ff8a8860de1-7ff8a8860df1 2651->2654 2660 7ff8a8860c1e-7ff8a8860c30 2652->2660 2661 7ff8a8860c35-7ff8a8860c3e 2652->2661 2654->2592 2655->2632 2660->2578 2662 7ff8a8860c58-7ff8a8860cb0 2661->2662 2663 7ff8a8860c40-7ff8a8860c43 2661->2663 2662->2545 2669 7ff8a8860cb6-7ff8a8860cce 2662->2669 2663->2662 2664 7ff8a8860c45-7ff8a8860c55 2663->2664 2664->2662 2669->2585
                                                                            APIs
                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF8A88607DA
                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00007FF8A886080E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: -data$-format$-translation$IMAGE$MALLOC$MISSING_VALUE$PHOTO$PHOTO_FILE$SAFE$binary$can't get image from a file in a safe interpreter$not enough free memory for image buffer$value for "-data" missing$value for "-format" missing
                                                                            • API String ID: 1114863663-986971618
                                                                            • Opcode ID: d736450ef21f9067e3c94fe29ba85f94775d05f0ac9db008fc0801f7769bedf8
                                                                            • Instruction ID: bf99d3527f0688a1b333f07f00276cdeece4e1f9e9b2f3d6d405b631f24d06ac
                                                                            • Opcode Fuzzy Hash: d736450ef21f9067e3c94fe29ba85f94775d05f0ac9db008fc0801f7769bedf8
                                                                            • Instruction Fuzzy Hash: 4A328B32F0AB46A6EB648F26E44426A77A0FB88BC1F084176CE5E53764DF7CE450C718
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A870CDF0 Relevance: 20.2, APIs: 4, Strings: 9, Instructions: 676stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strchr
                                                                            • String ID: %s called with shared object$/$Tcl_SetObjLength$Tcl_SetObjLength: negative length requested: %d (integer overflow?)$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$max length for a Tcl unicode value (%d chars) exceeded$unable to alloc %u bytes$unable to realloc %u bytes
                                                                            • API String ID: 2830005266-3012010624
                                                                            • Opcode ID: 8c9ad2f83408a53f20484e33a4186f94844ba7f8cc445ae135344d8122b802cd
                                                                            • Instruction ID: 04faa5192216eedb619e9fd390d3d2e335d748bfcd890be499162ba23e13f416
                                                                            • Opcode Fuzzy Hash: 8c9ad2f83408a53f20484e33a4186f94844ba7f8cc445ae135344d8122b802cd
                                                                            • Instruction Fuzzy Hash: 6E52DD62E8B746A6EA64DF11D1502396FB0EF44BC4F188231DA5D47B95DF2CF8918328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88610E0 Relevance: 19.8, APIs: 13, Instructions: 257COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset$CombineCreateDeleteObjectRectmemcpy$Indirect
                                                                            • String ID:
                                                                            • API String ID: 2081876822-0
                                                                            • Opcode ID: 5eff0881f56fc3765b84c1fd2e59a408f0881c833ca2a30e969e9ed6f6b7e50f
                                                                            • Instruction ID: 5991b71255c32bfffddbd0ada0a6a2a35841e8d90fe008992486b7406c3c7b1f
                                                                            • Opcode Fuzzy Hash: 5eff0881f56fc3765b84c1fd2e59a408f0881c833ca2a30e969e9ed6f6b7e50f
                                                                            • Instruction Fuzzy Hash: 1AA1D666B0A64292E7689F26A44123E77E2FF44FC5F040175DA9E43B95EF3CD441C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8804370 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Rect$MessageMoveSend$AdjustClientDrawIconicMenuMetricsSystemZoomed
                                                                            • String ID:
                                                                            • API String ID: 722483491-0
                                                                            • Opcode ID: 5dc5ee2d82364ab45c3e1c4c4de4c407ddad4bd6f2bd69f41bdf99dfc362b757
                                                                            • Instruction ID: 7a2454b265af5ca1806386f985a6dc73f8736fa3067df93ee39420ec1e9d77be
                                                                            • Opcode Fuzzy Hash: 5dc5ee2d82364ab45c3e1c4c4de4c407ddad4bd6f2bd69f41bdf99dfc362b757
                                                                            • Instruction Fuzzy Hash: 5AC1AB3770A6829AE710CF29D4447AD77B1FB84F88F194175CE895BA58DF3CE8408B64
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8692D10 Relevance: 18.4, APIs: 4, Strings: 8, Instructions: 424COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LeaveCriticalSection.KERNEL32 ref: 00007FF8A8693186
                                                                              • Part of subcall function 00007FF8A8693EB0: LeaveCriticalSection.KERNEL32 ref: 00007FF8A8693FB7
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            • memset.VCRUNTIME140 ref: 00007FF8A869324A
                                                                            • memset.VCRUNTIME140 ref: 00007FF8A869327A
                                                                            • memset.VCRUNTIME140 ref: 00007FF8A86932A4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset$CriticalHeapLeaveSection$AllocAllocateErrorLastProcessValue
                                                                            • String ID: *.enc$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$identity$iso8859-1$unable to alloc %u bytes$unicode$utf-8
                                                                            • API String ID: 2106447590-4101928241
                                                                            • Opcode ID: 3fe89046746eab9d5e9d05839165722938baa15c42a5ad5ad87f8a86cdcf66cc
                                                                            • Instruction ID: 1cd9ecfda3b5fddd64397363df0e311513bd089edff4207110c0021d20fac0cb
                                                                            • Opcode Fuzzy Hash: 3fe89046746eab9d5e9d05839165722938baa15c42a5ad5ad87f8a86cdcf66cc
                                                                            • Instruction Fuzzy Hash: 0212AA72A4AB46A5FB50DF21E4882B973A4FB44BC8F405135CA4D47BA8EF3CE455C368
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A86C6270 Relevance: 18.0, APIs: 5, Strings: 5, Instructions: 466COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memchrmemcpy$AllocBoundaryDeleteDescriptorErrorHeapLastProcessValue_errno
                                                                            • String ID: Reuse of ChannelBuffer! %p$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$unable to alloc %u bytes$unknown output translation requested
                                                                            • API String ID: 745590242-1795497851
                                                                            • Opcode ID: 57c36b8b1879d881c374ae6a15f0348553f1e05cb291dd281d4249166970a0f4
                                                                            • Instruction ID: 81231640581008a9ce14acff2eedde3c076472fa0cb1e69c2cdd122076c9a194
                                                                            • Opcode Fuzzy Hash: 57c36b8b1879d881c374ae6a15f0348553f1e05cb291dd281d4249166970a0f4
                                                                            • Instruction Fuzzy Hash: 3A12C2B2A0A78196EB64CF25E84437AB7A0FB847D8F149039DB4D47A94DF3CE454CB18
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F5380 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 274COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: DataFont$ObjectSelect$CharsetText
                                                                            • String ID: cmap$pamc
                                                                            • API String ID: 447340330-4234804082
                                                                            • Opcode ID: bbebad4b024f1df0a2acf8f01e802d18b25ea7676657321c3d9a359de27d5bdf
                                                                            • Instruction ID: 12d6fda645e5d25284475dea354a6053df12051d862e154ba8df4032802079d3
                                                                            • Opcode Fuzzy Hash: bbebad4b024f1df0a2acf8f01e802d18b25ea7676657321c3d9a359de27d5bdf
                                                                            • Instruction Fuzzy Hash: 45B12476A1926287D7548F16E40027EB7E1FB99B81F404036EF8947B98EFBCD845CB24
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8683310 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 291COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memcpy
                                                                            • String ID: GetCmdLocEncodingSize: bad code length$GetCmdLocEncodingSize: bad code offset$GetCmdLocEncodingSize: bad source length$TclInitByteCodeObj() called on uninitialized CompileEnv$unable to alloc %u bytes
                                                                            • API String ID: 3510742995-538860164
                                                                            • Opcode ID: 947d286a219c7a30c2cf8b1ea2e3c7ecc4ce9d346809b24cca5057dd83fbd34e
                                                                            • Instruction ID: eed2c7381a4e16ec266ea1ea1d53f660f410fc2b95d8800e7cd38a8c526394e1
                                                                            • Opcode Fuzzy Hash: 947d286a219c7a30c2cf8b1ea2e3c7ecc4ce9d346809b24cca5057dd83fbd34e
                                                                            • Instruction Fuzzy Hash: BDC1BB72B0AB80A6EB64CF15E5847A973A4FB48B94F154139DF5D83B50EF38E4A0C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8682510 Relevance: 11.2, APIs: 2, Strings: 5, Instructions: 663COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memcpy
                                                                            • String ID: $Unexpected token type in TclCompileTokens: %d; %.*s$bad stack depth computations: is %i, should be %i$unable to alloc %u bytes$unable to realloc %u bytes
                                                                            • API String ID: 3510742995-2435792223
                                                                            • Opcode ID: 45f269541b0e51e17627ff3a3ef9661671a7875a0ce8f9a3a4f28c393e98da19
                                                                            • Instruction ID: 1667d91c38179fa256b4fb86eeb023969cabab3c53afa0bffc617c8ef2f37aa4
                                                                            • Opcode Fuzzy Hash: 45f269541b0e51e17627ff3a3ef9661671a7875a0ce8f9a3a4f28c393e98da19
                                                                            • Instruction Fuzzy Hash: 1D529F32A0A68196FB108F29D44437E77A0FB94B98F146136DE4E47799EF3CD841CB64
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A871F070 Relevance: 65.3, APIs: 33, Strings: 4, Instructions: 564memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F0FA
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A871F123
                                                                            • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F131
                                                                            • memcpy.VCRUNTIME140(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F1CB
                                                                            • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F1D9
                                                                            • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F20C
                                                                            • HeapReAlloc.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F21D
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A871F24C
                                                                            • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F25A
                                                                            • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F298
                                                                            • HeapFree.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F2A6
                                                                            • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F367
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A871F390
                                                                            • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F39E
                                                                            • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F46E
                                                                            • memcpy.VCRUNTIME140(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F4CF
                                                                            • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F4DD
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A871F506
                                                                            • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F514
                                                                            • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F552
                                                                            • HeapFree.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F560
                                                                            • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F5FC
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A871F625
                                                                            • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F633
                                                                            • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F6D2
                                                                            • HeapReAlloc.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F6E3
                                                                            • HeapReAlloc.KERNEL32(?,?,?,?,?,00000000,00007FF8A87237F5,?,00000000,00000000,?,?,?,00000000,00007FF8A872077E), ref: 00007FF8A871F47F
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Heap$Alloc$ErrorLastProcessValue$Freememcpy$Allocate
                                                                            • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage$unable to realloc %u bytes
                                                                            • API String ID: 1881453535-2645962790
                                                                            • Opcode ID: 9c2ffa12e6c4be177d6d31877abb48ef0ec97001b6965ee56833acfd7e1dbab7
                                                                            • Instruction ID: 0208ecd03c3c5a496a33a20c869cb7580f205e7d18feffe508a482f1ad9956d5
                                                                            • Opcode Fuzzy Hash: 9c2ffa12e6c4be177d6d31877abb48ef0ec97001b6965ee56833acfd7e1dbab7
                                                                            • Instruction Fuzzy Hash: 5E42C171A8BB42B6EB109B25A44067C77A1FF48BC4F048135CA1D43BA1EF3DE455C729
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F2020 Relevance: 63.2, APIs: 27, Strings: 9, Instructions: 183COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Object$CreateDeleteFontIndirect$InfoParametersSystem$CapsDeviceReleaseStockmemset
                                                                            • String ID: TkCaptionFont$TkDefaultFont$TkFixedFont$TkHeadingFont$TkIconFont$TkMenuFont$TkSmallCaptionFont$TkTextFont$TkTooltipFont
                                                                            • API String ID: 3615235001-2508811397
                                                                            • Opcode ID: c1a13152ffc53438591685186ff9e8c3d61c07655ef8a1d46dd18468c0637432
                                                                            • Instruction ID: e72f51f7e98726750d7b6d0a5bad3e21bfe5582d896e48fa5666bb35869eeb2a
                                                                            • Opcode Fuzzy Hash: c1a13152ffc53438591685186ff9e8c3d61c07655ef8a1d46dd18468c0637432
                                                                            • Instruction Fuzzy Hash: 46816B21B0AA43A6EB00DB62EC542F92360FB48FC9F404075D94E57B54EF3CDA49C768
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A885AA80 Relevance: 56.5, APIs: 1, Strings: 31, Instructions: 509COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 840 7ff8a885aa80-7ff8a885aaca call 7ff8a88595a0 843 7ff8a885ae37 840->843 844 7ff8a885aad0-7ff8a885aae8 840->844 845 7ff8a885ae3c-7ff8a885ae6e call 7ff8a88df7a0 843->845 846 7ff8a885ac1c-7ff8a885ac3e call 7ff8a8858fb0 844->846 847 7ff8a885aaee-7ff8a885ab0d 844->847 846->843 853 7ff8a885ac44-7ff8a885ac52 846->853 847->843 854 7ff8a885ab13-7ff8a885ab18 847->854 855 7ff8a885ac58-7ff8a885ac63 853->855 856 7ff8a885af0b-7ff8a885af0e 853->856 854->846 857 7ff8a885ab1e-7ff8a885ab2d 854->857 858 7ff8a885ac69-7ff8a885ac70 855->858 859 7ff8a885aea4-7ff8a885aed0 855->859 860 7ff8a885ad48-7ff8a885ad4e 856->860 861 7ff8a885af14-7ff8a885af47 856->861 862 7ff8a885ab30-7ff8a885ab52 _stricmp 857->862 863 7ff8a885ae6f-7ff8a885aea2 858->863 864 7ff8a885ac76-7ff8a885ac7c 858->864 890 7ff8a885aed7-7ff8a885af06 859->890 865 7ff8a885ad9a-7ff8a885ada0 860->865 866 7ff8a885ad50-7ff8a885ad68 call 7ff8a88599f0 860->866 861->890 875 7ff8a885abfc-7ff8a885ac01 862->875 876 7ff8a885ab58-7ff8a885ab94 862->876 863->890 864->863 869 7ff8a885ac82-7ff8a885ac95 864->869 871 7ff8a885af49-7ff8a885af73 call 7ff8a8863020 865->871 872 7ff8a885ada6-7ff8a885add9 865->872 866->843 883 7ff8a885ad6e-7ff8a885ad90 call 7ff8a8858fb0 866->883 869->863 877 7ff8a885ac9b-7ff8a885acbb call 7ff8a8858a50 869->877 871->843 888 7ff8a885af79-7ff8a885af92 871->888 872->890 884 7ff8a885ac05-7ff8a885ac16 875->884 876->843 896 7ff8a885ab9a-7ff8a885aba1 876->896 877->843 897 7ff8a885acc1-7ff8a885acd4 call 7ff8a8858e30 877->897 883->843 905 7ff8a885ad96 883->905 884->846 884->862 894 7ff8a885afcc-7ff8a885afd6 888->894 895 7ff8a885af94-7ff8a885afc7 888->895 890->843 902 7ff8a885afd8-7ff8a885afe0 894->902 903 7ff8a885afe2-7ff8a885b008 894->903 895->890 899 7ff8a885aba7-7ff8a885abc0 896->899 900 7ff8a885ae16-7ff8a885ae2e 896->900 897->843 912 7ff8a885acda-7ff8a885acdf 897->912 899->884 907 7ff8a885abc2-7ff8a885abdc 899->907 900->843 908 7ff8a885b00e 902->908 909 7ff8a885b00a 903->909 910 7ff8a885b014-7ff8a885b047 903->910 905->865 907->843 919 7ff8a885abe2-7ff8a885abe7 907->919 908->910 909->908 981 7ff8a885b04a call 7ff8a86369e0 910->981 982 7ff8a885b04a call 7ff8a87308b0 910->982 915 7ff8a885ad18-7ff8a885ad3e call 7ff8a8858fb0 912->915 916 7ff8a885ace1-7ff8a885aceb 912->916 915->843 925 7ff8a885ad44 915->925 920 7ff8a885acf0-7ff8a885ad16 916->920 923 7ff8a885abed-7ff8a885abf6 919->923 924 7ff8a885adde-7ff8a885ae11 919->924 920->915 920->920 923->875 923->924 924->890 925->860 926 7ff8a885b050-7ff8a885b057 928 7ff8a885b0a9-7ff8a885b0ad 926->928 929 7ff8a885b059-7ff8a885b0a4 926->929 931 7ff8a885b0af-7ff8a885b0c6 928->931 932 7ff8a885b0ee-7ff8a885b0fa 928->932 929->843 935 7ff8a885b0cf-7ff8a885b0d8 931->935 936 7ff8a885b0c8-7ff8a885b0cd 931->936 933 7ff8a885b100-7ff8a885b118 call 7ff8a885a7f0 932->933 933->843 943 7ff8a885b11e-7ff8a885b140 call 7ff8a8858fb0 933->943 938 7ff8a885b0db-7ff8a885b0ea 935->938 936->938 939 7ff8a885b0ec 938->939 940 7ff8a885b152-7ff8a885b168 938->940 939->933 948 7ff8a885b16a-7ff8a885b194 940->948 949 7ff8a885b1a0-7ff8a885b1a6 940->949 943->843 952 7ff8a885b146-7ff8a885b150 943->952 948->949 950 7ff8a885b1a8 949->950 951 7ff8a885b200-7ff8a885b205 949->951 953 7ff8a885b1b0-7ff8a885b1c8 call 7ff8a8858f10 950->953 954 7ff8a885b23f-7ff8a885b252 call 7ff8a8858e30 951->954 955 7ff8a885b207-7ff8a885b233 951->955 952->933 952->940 953->843 964 7ff8a885b1ce-7ff8a885b1f0 call 7ff8a8858fb0 953->964 954->843 963 7ff8a885b258-7ff8a885b261 954->963 955->954 966 7ff8a885b269-7ff8a885b281 963->966 967 7ff8a885b263 963->967 964->843 974 7ff8a885b1f6-7ff8a885b1fe 964->974 969 7ff8a885b2f0-7ff8a885b320 call 7ff8a8861bd0 966->969 970 7ff8a885b283-7ff8a885b287 966->970 967->966 967->969 969->843 979 7ff8a885b326-7ff8a885b328 969->979 972 7ff8a885b289 970->972 973 7ff8a885b2ca-7ff8a885b2cf 970->973 977 7ff8a885b290-7ff8a885b2c6 972->977 978 7ff8a885b2d0-7ff8a885b2ee 973->978 974->951 974->953 977->977 980 7ff8a885b2c8 977->980 978->969 978->978 979->845 980->969 981->926 982->926
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memcmp$_stricmp
                                                                            • String ID: -alpha value must be between 0.0 and 1.0$BAD_ALPHA$BAD_IEND$BAD_PLTE$DNEI$DNEI$ETLP$EXTRA_DATA$IEND chunk contents must be empty$IMAGE$LINE_SIZE$MALLOC$NEED_IDAT$NEED_PLTE$PLTE chunk required for indexed color$PLTE chunk type forbidden for grayscale$PLTE_UNEXPECTED$PNG$SNRt$TADI$TADI$TADI$VUUU$at least one IDAT chunk is required$invalid palette chunk size$line size is out of supported range on this architecture$memory allocation failed$option$png$unfinalized data stream in PNG data$value
                                                                            • API String ID: 190063134-2027502129
                                                                            • Opcode ID: a1c45e39a4f9ff24e34f71d1879086735fc1645dc484251a5ad6f1c183f35170
                                                                            • Instruction ID: accbe45264ee80bb455b1fbc485817e7448f87cd67d71ed8bfa4ec190271c87a
                                                                            • Opcode Fuzzy Hash: a1c45e39a4f9ff24e34f71d1879086735fc1645dc484251a5ad6f1c183f35170
                                                                            • Instruction Fuzzy Hash: 02321032B0AA86A6DB18CF25E4842BE77A1FB85BC5F044172DA4D43BA4DF3DE544C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87308B0 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 184memorythreadCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1796 7ff8a87308b0-7ff8a87308c7 1797 7ff8a87309e9-7ff8a87309f4 call 7ff8a8779a50 1796->1797 1798 7ff8a87308cd-7ff8a87308d4 1796->1798 1804 7ff8a8730a71-7ff8a8730a83 1797->1804 1805 7ff8a87309f6-7ff8a8730a13 GetProcessHeap HeapAlloc 1797->1805 1800 7ff8a87308ed-7ff8a8730901 call 7ff8a87795c0 1798->1800 1801 7ff8a87308d6-7ff8a87308e3 InitializeCriticalSection 1798->1801 1809 7ff8a87309dc-7ff8a87309e3 LeaveCriticalSection 1800->1809 1810 7ff8a8730907-7ff8a8730918 malloc 1800->1810 1801->1800 1807 7ff8a8730a84-7ff8a8730a90 call 7ff8a8708bd0 1805->1807 1808 7ff8a8730a15-7ff8a8730a6f memset call 7ff8a87795c0 LeaveCriticalSection GetCurrentThreadId TlsSetValue 1805->1808 1814 7ff8a8730a91-7ff8a8730a9d call 7ff8a8708bd0 1807->1814 1808->1804 1819 7ff8a8730a9e-7ff8a8730ada call 7ff8a8708bd0 TlsAlloc 1808->1819 1809->1797 1813 7ff8a873091e-7ff8a8730943 InitializeCriticalSection malloc 1810->1813 1810->1814 1813->1814 1817 7ff8a8730949-7ff8a8730966 InitializeCriticalSection 1813->1817 1814->1819 1820 7ff8a8730970-7ff8a873099a 1817->1820 1829 7ff8a8730ae0-7ff8a8730afb TlsGetValue 1819->1829 1830 7ff8a8730be4-7ff8a8730bf0 call 7ff8a8708bd0 1819->1830 1823 7ff8a873099c-7ff8a87309a4 1820->1823 1824 7ff8a87309a6-7ff8a87309ba malloc 1820->1824 1823->1824 1824->1814 1826 7ff8a87309c0-7ff8a87309da InitializeCriticalSection 1824->1826 1826->1809 1826->1820 1833 7ff8a8730b0b-7ff8a8730b13 1829->1833 1834 7ff8a8730afd-7ff8a8730b05 GetLastError 1829->1834 1838 7ff8a8730bf1-7ff8a8730bff call 7ff8a8708bd0 1830->1838 1836 7ff8a8730b1d-7ff8a8730b55 GetProcessHeap RtlAllocateHeap 1833->1836 1837 7ff8a8730b15-7ff8a8730b1a call 7ff8a87308b0 1833->1837 1834->1833 1834->1838 1844 7ff8a8730b9f-7ff8a8730ba1 1836->1844 1845 7ff8a8730b57-7ff8a8730b5a 1836->1845 1837->1836 1846 7ff8a8730bb7-7ff8a8730bc6 1844->1846 1847 7ff8a8730bca-7ff8a8730be3 1844->1847 1845->1846 1846->1847
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CriticalSection$Initialize$malloc$AllocHeapLeaveValue$CurrentErrorLastProcessThreadmemset
                                                                            • String ID: TlsGetValue failed from TclpGetAllocCache$TlsSetValue failed from TclpSetAllocCache$alloc: could not allocate new cache$could not allocate lock$could not allocate thread local storage
                                                                            • API String ID: 2510295087-2583951768
                                                                            • Opcode ID: 7739486442db3a8f0720ca2a92c364d070dea4b4dea3eb3c19542412d3bcd4d7
                                                                            • Instruction ID: 6f5dda6da38565f6c66285a9af106fa2a972129e62c0ecad47b5882566922085
                                                                            • Opcode Fuzzy Hash: 7739486442db3a8f0720ca2a92c364d070dea4b4dea3eb3c19542412d3bcd4d7
                                                                            • Instruction Fuzzy Hash: CE817F71E8BB06A6FB109B25E85437963A0EF88BC4F548035C64E477A4EF3CE545C729
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A884894D Relevance: 36.3, APIs: 6, Strings: 18, Instructions: 335stringCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1848 7ff8a884894d-7ff8a884895b 1849 7ff8a8848960-7ff8a8848986 1848->1849 1851 7ff8a884898c-7ff8a8848990 1849->1851 1852 7ff8a8848ac0-7ff8a8848ac8 1849->1852 1853 7ff8a88489cf-7ff8a88489d3 1851->1853 1854 7ff8a8848992-7ff8a8848995 1851->1854 1852->1849 1855 7ff8a8848ace-7ff8a8848ad6 1852->1855 1859 7ff8a88489d5-7ff8a88489d8 1853->1859 1860 7ff8a8848a10-7ff8a8848a14 1853->1860 1854->1853 1856 7ff8a8848997-7ff8a88489ac strncmp 1854->1856 1857 7ff8a8848ad8-7ff8a8848ae6 1855->1857 1858 7ff8a8848aea-7ff8a8848b9f call 7ff8a88b6d90 call 7ff8a88b5750 1855->1858 1863 7ff8a88489ae-7ff8a88489c3 1856->1863 1864 7ff8a88489c8 1856->1864 1857->1858 1890 7ff8a8848ba5-7ff8a8848bb2 1858->1890 1891 7ff8a8848f00 1858->1891 1859->1860 1866 7ff8a88489da-7ff8a88489ef strncmp 1859->1866 1861 7ff8a8848a4f-7ff8a8848a53 1860->1861 1862 7ff8a8848a16-7ff8a8848a1a 1860->1862 1868 7ff8a8848a8e-7ff8a8848a92 1861->1868 1869 7ff8a8848a55-7ff8a8848a59 1861->1869 1862->1861 1867 7ff8a8848a1c-7ff8a8848a31 strncmp 1862->1867 1863->1852 1864->1853 1871 7ff8a8848a09 1866->1871 1872 7ff8a88489f1-7ff8a8848a04 1866->1872 1874 7ff8a8848a48 1867->1874 1875 7ff8a8848a33-7ff8a8848a46 1867->1875 1868->1852 1873 7ff8a8848a94-7ff8a8848aa9 strncmp 1868->1873 1869->1868 1877 7ff8a8848a5b-7ff8a8848a70 strncmp 1869->1877 1871->1860 1872->1852 1873->1852 1879 7ff8a8848aab-7ff8a8848abb 1873->1879 1874->1861 1875->1852 1880 7ff8a8848a87 1877->1880 1881 7ff8a8848a72-7ff8a8848a85 1877->1881 1879->1852 1880->1868 1881->1852 1892 7ff8a8848bb4-7ff8a8848bd0 call 7ff8a887bc70 1890->1892 1893 7ff8a8848be6-7ff8a8848bfd call 7ff8a884c210 call 7ff8a887c2e0 1890->1893 1894 7ff8a8848f05-7ff8a8848f2b 1891->1894 1892->1893 1899 7ff8a8848bd2-7ff8a8848bde 1892->1899 1902 7ff8a8848c1d-7ff8a8848c22 1893->1902 1903 7ff8a8848bff-7ff8a8848c10 call 7ff8a887bc70 1893->1903 1899->1893 1905 7ff8a8848c3a-7ff8a8848c42 1902->1905 1906 7ff8a8848c24-7ff8a8848c34 call 7ff8a87f1650 1902->1906 1909 7ff8a8848c15-7ff8a8848c1b 1903->1909 1907 7ff8a8848c5d-7ff8a8848c60 1905->1907 1908 7ff8a8848c44-7ff8a8848c5a call 7ff8a887bc70 1905->1908 1906->1905 1915 7ff8a8848ef8-7ff8a8848efb call 7ff8a88b5a30 1906->1915 1913 7ff8a8848c80-7ff8a8848c8d 1907->1913 1914 7ff8a8848c62-7ff8a8848c7e call 7ff8a887bc70 1907->1914 1908->1907 1909->1902 1909->1905 1918 7ff8a8848c92-7ff8a8848c95 1913->1918 1914->1913 1925 7ff8a8848c8f 1914->1925 1915->1891 1921 7ff8a8848cff-7ff8a8848d02 1918->1921 1922 7ff8a8848c97-7ff8a8848cbe call 7ff8a88b3cf0 1918->1922 1923 7ff8a8848d2b-7ff8a8848d3f 1921->1923 1924 7ff8a8848d04-7ff8a8848d1a call 7ff8a88b43c0 1921->1924 1922->1915 1933 7ff8a8848cc4-7ff8a8848cce 1922->1933 1931 7ff8a8848d4d-7ff8a8848d6b 1923->1931 1932 7ff8a8848d41-7ff8a8848d4b 1923->1932 1924->1915 1935 7ff8a8848d20-7ff8a8848d26 call 7ff8a88b6800 1924->1935 1925->1918 1936 7ff8a8848d82-7ff8a8848e06 memset 1931->1936 1937 7ff8a8848d6d-7ff8a8848d74 1931->1937 1932->1931 1932->1936 1933->1921 1934 7ff8a8848cd0-7ff8a8848cf4 1933->1934 1934->1921 1938 7ff8a8848cf6-7ff8a8848cf9 1934->1938 1935->1923 1943 7ff8a8848e08-7ff8a8848e12 1936->1943 1944 7ff8a8848e19-7ff8a8848e64 call 7ff8a88407c0 call 7ff8a8837a80 1936->1944 1937->1936 1940 7ff8a8848d76-7ff8a8848d7d 1937->1940 1938->1921 1940->1936 1943->1944 1944->1915 1949 7ff8a8848e6a-7ff8a8848e8f call 7ff8a8849470 1944->1949 1949->1915 1952 7ff8a8848e91-7ff8a8848e97 1949->1952 1953 7ff8a8848e9d-7ff8a8848ea5 1952->1953 1954 7ff8a8848f58-7ff8a8848f5c 1952->1954 1957 7ff8a8848eab-7ff8a8848eef 1953->1957 1958 7ff8a8848f50-7ff8a8848f53 call 7ff8a87f18d0 1953->1958 1955 7ff8a8848f5e-7ff8a8848f6c 1954->1955 1956 7ff8a8848f75-7ff8a8848f92 call 7ff8a8879fb0 1954->1956 1955->1956 1956->1894 1957->1915 1958->1954
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: -class$-colormap$-screen$-use$-visual$CONTAINMENT$Class$Colormap$FRAME$Use$Visual$class$colormap$use$v$visual$windows cannot have both the -use and the -container option set$"6
                                                                            • API String ID: 1114863663-646938501
                                                                            • Opcode ID: f7413b5202df08c6a529bb41f8151afdd6ac3aac6e59a64dd44c62e999cebe4e
                                                                            • Instruction ID: 4736e824498450c8bd286da71cc39b6d15eb19d1fe135da0241d00b2b9663f9f
                                                                            • Opcode Fuzzy Hash: f7413b5202df08c6a529bb41f8151afdd6ac3aac6e59a64dd44c62e999cebe4e
                                                                            • Instruction Fuzzy Hash: 27F18932B0AB86A5EB649B22E5443B963A1FF49BC4F084475CE5E07794DF7CE424C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87EF590 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 228windowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 2325 7ff8a87ef590-7ff8a87ef5cc call 7ff8a87eeaf0 2327 7ff8a87ef5d1-7ff8a87ef618 SetROP2 CreateCompatibleDC 2325->2327 2328 7ff8a87ef61e-7ff8a87ef622 2327->2328 2329 7ff8a87ef728-7ff8a87ef73a 2327->2329 2330 7ff8a87ef624-7ff8a87ef628 2328->2330 2331 7ff8a87ef64f-7ff8a87ef65a 2328->2331 2332 7ff8a87ef741-7ff8a87ef77e 2329->2332 2333 7ff8a87ef73c 2329->2333 2330->2331 2334 7ff8a87ef62a-7ff8a87ef64a CreateBitmap 2330->2334 2335 7ff8a87ef663-7ff8a87ef665 2331->2335 2336 7ff8a87ef65c-7ff8a87ef661 2331->2336 2341 7ff8a87ef780-7ff8a87ef788 2332->2341 2342 7ff8a87ef7ba 2332->2342 2333->2332 2337 7ff8a87ef709-7ff8a87ef723 SetTextColor SetBkColor 2334->2337 2338 7ff8a87ef667-7ff8a87ef66e 2335->2338 2339 7ff8a87ef670-7ff8a87ef691 2335->2339 2336->2335 2343 7ff8a87ef7ee-7ff8a87ef7f1 2337->2343 2338->2339 2352 7ff8a87ef693-7ff8a87ef6a6 2339->2352 2353 7ff8a87ef6e1-7ff8a87ef6ff CreateBitmap 2339->2353 2344 7ff8a87ef7be-7ff8a87ef7e4 CreateDIBitmap 2341->2344 2345 7ff8a87ef78a-7ff8a87ef78e 2341->2345 2342->2344 2346 7ff8a87ef804-7ff8a87ef8bb SelectObject BitBlt SelectObject DeleteObject DeleteDC SetBkMode SelectPalette RealizePalette 2343->2346 2347 7ff8a87ef7f3-7ff8a87ef7fa 2343->2347 2344->2343 2349 7ff8a87ef791-7ff8a87ef7b6 2345->2349 2350 7ff8a87ef8cc-7ff8a87ef8cf 2346->2350 2351 7ff8a87ef8bd-7ff8a87ef8ca ReleaseDC 2346->2351 2347->2346 2349->2349 2356 7ff8a87ef7b8 2349->2356 2357 7ff8a87ef8da-7ff8a87ef8f9 2350->2357 2358 7ff8a87ef8d1-7ff8a87ef8d4 DeleteDC 2350->2358 2351->2357 2354 7ff8a87ef6d6-7ff8a87ef6df 2352->2354 2355 7ff8a87ef6a8-7ff8a87ef6ab 2352->2355 2353->2337 2354->2352 2354->2353 2359 7ff8a87ef6b1-7ff8a87ef6b5 2355->2359 2360 7ff8a87ef6ad-7ff8a87ef6af 2355->2360 2356->2344 2358->2357 2362 7ff8a87ef6b7-7ff8a87ef6c2 2359->2362 2363 7ff8a87ef6c4 2359->2363 2361 7ff8a87ef6ca-7ff8a87ef6d4 2360->2361 2361->2354 2361->2355 2364 7ff8a87ef6c7 2362->2364 2363->2364 2364->2361
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CreatePaletteSelect$BitmapDeleteObject$ColorModeRealize$CompatibleReleaseText
                                                                            • String ID: $Fail to allocate bitmap
                                                                            • API String ID: 455095717-3619745282
                                                                            • Opcode ID: e8f7df91cba323eb5b641266ae87e1f30962e327d6340d657d6a3a7cae8a3e9a
                                                                            • Instruction ID: 34a9047a03a90f247a82e20e7ca0e37c8e8db52c566980051f634f400fdbe331
                                                                            • Opcode Fuzzy Hash: e8f7df91cba323eb5b641266ae87e1f30962e327d6340d657d6a3a7cae8a3e9a
                                                                            • Instruction Fuzzy Hash: 2EA1AB3660A68197D724CF26E44462D77A1FB89BC6F149076CE8E43B64EF3CE440CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87FDB90 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 269windowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 2421 7ff8a87fdb90-7ff8a87fdbb4 2422 7ff8a87fdbb6-7ff8a87fdbbe call 7ff8a88b6d90 2421->2422 2423 7ff8a87fdbc2-7ff8a87fdbce 2421->2423 2422->2423 2424 7ff8a87fdc32-7ff8a87fdc3b 2423->2424 2425 7ff8a87fdbd0-7ff8a87fdc2d 2423->2425 2427 7ff8a87fdc45-7ff8a87fdc54 2424->2427 2428 7ff8a87fdc3d-7ff8a87fdc40 call 7ff8a88b6110 2424->2428 2464 7ff8a87fdf60-7ff8a87fdf78 2425->2464 2432 7ff8a87fddcd-7ff8a87fddd3 2427->2432 2433 7ff8a87fdc5a-7ff8a87fdc5d 2427->2433 2428->2427 2434 7ff8a87fddd5-7ff8a87fddd7 call 7ff8a87fd9b0 2432->2434 2435 7ff8a87fdddc-7ff8a87fdddf 2432->2435 2436 7ff8a87fdc67-7ff8a87fdc6d 2433->2436 2437 7ff8a87fdc5f-7ff8a87fdc63 2433->2437 2434->2435 2440 7ff8a87fdde1-7ff8a87fddf9 call 7ff8a87fecf0 2435->2440 2441 7ff8a87fde60-7ff8a87fde63 2435->2441 2442 7ff8a87fdcb0-7ff8a87fdcb3 2436->2442 2443 7ff8a87fdc6f-7ff8a87fdc79 call 7ff8a87fd9b0 2436->2443 2437->2436 2440->2441 2469 7ff8a87fddfb-7ff8a87fde20 2440->2469 2444 7ff8a87fde65-7ff8a87fde79 SendMessageW 2441->2444 2445 7ff8a87fde7e-7ff8a87fde85 2441->2445 2446 7ff8a87fdcb5-7ff8a87fdcc5 SetClassLongPtrW 2442->2446 2447 7ff8a87fdcca-7ff8a87fdcd1 2442->2447 2459 7ff8a87fdc7f-7ff8a87fdcab 2443->2459 2460 7ff8a87fdf59 2443->2460 2451 7ff8a87fdf2a-7ff8a87fdf4a SendMessageW 2444->2451 2452 7ff8a87fde87-7ff8a87fde8f 2445->2452 2453 7ff8a87fded3 2445->2453 2455 7ff8a87fdd79-7ff8a87fddad SetClassLongPtrW 2446->2455 2456 7ff8a87fdcd3-7ff8a87fdcdb 2447->2456 2457 7ff8a87fdd1f 2447->2457 2465 7ff8a87fdf51 2451->2465 2466 7ff8a87fdf4c call 7ff8a87fe100 2451->2466 2462 7ff8a87fdeb7-7ff8a87fdebb 2452->2462 2463 7ff8a87fde91-7ff8a87fde94 2452->2463 2470 7ff8a87fded6-7ff8a87fdeee SendMessageW 2453->2470 2490 7ff8a87fddb4-7ff8a87fddb8 2455->2490 2491 7ff8a87fddaf call 7ff8a87fe100 2455->2491 2467 7ff8a87fdd03-7ff8a87fdd07 2456->2467 2468 7ff8a87fdcdd-7ff8a87fdce0 2456->2468 2461 7ff8a87fdd22-7ff8a87fdd37 SetClassLongPtrW 2457->2461 2508 7ff8a87fde27-7ff8a87fde5b 2459->2508 2474 7ff8a87fdf5b 2460->2474 2461->2455 2476 7ff8a87fdd39-7ff8a87fdd41 2461->2476 2462->2453 2478 7ff8a87fdebd-7ff8a87fdec1 2462->2478 2477 7ff8a87fde98-7ff8a87fde9c 2463->2477 2465->2460 2466->2465 2467->2457 2475 7ff8a87fdd09-7ff8a87fdd0d 2467->2475 2473 7ff8a87fdce4-7ff8a87fdce8 2468->2473 2469->2508 2470->2451 2471 7ff8a87fdef0-7ff8a87fdef8 2470->2471 2480 7ff8a87fdf20-7ff8a87fdf24 2471->2480 2481 7ff8a87fdefa-7ff8a87fdefd 2471->2481 2487 7ff8a87fdcf5-7ff8a87fdd01 2473->2487 2488 7ff8a87fdcea-7ff8a87fdced 2473->2488 2474->2464 2475->2461 2483 7ff8a87fdd43-7ff8a87fdd4a 2476->2483 2484 7ff8a87fdd6f-7ff8a87fdd73 2476->2484 2485 7ff8a87fde9e-7ff8a87fdea1 2477->2485 2486 7ff8a87fdea9-7ff8a87fdeb5 2477->2486 2478->2470 2480->2451 2494 7ff8a87fdf26 2480->2494 2493 7ff8a87fdf01-7ff8a87fdf05 2481->2493 2496 7ff8a87fdd50-7ff8a87fdd54 2483->2496 2484->2455 2498 7ff8a87fdd75 2484->2498 2485->2486 2497 7ff8a87fdea3-7ff8a87fdea7 2485->2497 2486->2462 2486->2477 2487->2467 2487->2473 2488->2487 2495 7ff8a87fdcef-7ff8a87fdcf3 2488->2495 2490->2460 2491->2490 2499 7ff8a87fdf07-7ff8a87fdf0a 2493->2499 2500 7ff8a87fdf12-7ff8a87fdf1e 2493->2500 2494->2451 2495->2487 2505 7ff8a87fdd0f-7ff8a87fdd1d 2495->2505 2502 7ff8a87fdd56-7ff8a87fdd59 2496->2502 2503 7ff8a87fdd61-7ff8a87fdd6d 2496->2503 2497->2486 2504 7ff8a87fdec3-7ff8a87fded1 2497->2504 2498->2455 2499->2500 2507 7ff8a87fdf0c-7ff8a87fdf10 2499->2507 2500->2480 2500->2493 2502->2503 2509 7ff8a87fdd5b-7ff8a87fdd5f 2502->2509 2503->2484 2503->2496 2504->2470 2505->2461 2507->2500 2510 7ff8a87fdf79-7ff8a87fdf87 2507->2510 2508->2474 2509->2503 2511 7ff8a87fddbd-7ff8a87fddcb 2509->2511 2510->2451 2511->2455
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Class$LongMessageSend$HandleLoadModule$CursorIconRegister
                                                                            • String ID: Can't set icon; window has no wrapper.$FAILED$ICON$LOOKUP$TOPLEVEL$Unable to set icon$WRAPPER$window "%s" isn't a top-level window
                                                                            • API String ID: 3636279047-342970489
                                                                            • Opcode ID: 00a33a114b96047e7b44c57dc76a09d9494fa9e4dbc6cb1768352b83b3718d4b
                                                                            • Instruction ID: 1072fd8209a56a760dfbc678f2258589fb8e919e3ac24c217ea4bcf904111a72
                                                                            • Opcode Fuzzy Hash: 00a33a114b96047e7b44c57dc76a09d9494fa9e4dbc6cb1768352b83b3718d4b
                                                                            • Instruction Fuzzy Hash: 6CB1A321B4A64AA2EB64DF52E4046B93FA1FB55BC5F084132DE1E47794DFBCE840C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8730C00 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 89memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: AllocBoundaryDeleteDescriptorErrorHeapLastProcessValue
                                                                            • String ID: %lu %ld %ld %ld %ld %ld %ld$TlsGetValue failed from TclpGetAllocCache$alloc: could not allocate %d new objects$alloc: invalid block: %p: %x %x$could not allocate thread local storage$shared$thread%p
                                                                            • API String ID: 3165723124-481911188
                                                                            • Opcode ID: e2dc0e0fc3bad6eae0e4b7e834c524aff7cd0846022070a7e4669c82e16029ef
                                                                            • Instruction ID: feb57365cc14027fc86a9d81f177c8a94c634b2e660af2af69aa154a5cb821ef
                                                                            • Opcode Fuzzy Hash: e2dc0e0fc3bad6eae0e4b7e834c524aff7cd0846022070a7e4669c82e16029ef
                                                                            • Instruction Fuzzy Hash: F641F671E9BA46AAEB508B29E44027C73A0FF04BD4F148135DA5D43794DF3DE452C729
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F3AE0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 156COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CharObjectSelectTextWidth$FaceMetricsRelease
                                                                            • String ID: unicode$utf-16
                                                                            • API String ID: 1149465119-3317161374
                                                                            • Opcode ID: 35174592a5108521a880005fbe9051792abcb74f6bef279d6261510abd6c8f00
                                                                            • Instruction ID: 03e11aa6f07b0955b4058473c160d96ef1faf09472d4811ad376fea47a4a0869
                                                                            • Opcode Fuzzy Hash: 35174592a5108521a880005fbe9051792abcb74f6bef279d6261510abd6c8f00
                                                                            • Instruction Fuzzy Hash: 9E719E72A0AA8AA6DB25DF26E4442AA73A0FB48FC5F044236DE4D47764EF3CD445C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A86369E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8636A4A
                                                                            • fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8636A53
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Heap$AllocAllocateErrorLastProcessValue__acrt_iob_funcfflush
                                                                            • String ID: unable to alloc %u bytes$unable to alloc %u bytes, %s line %d
                                                                            • API String ID: 2194035668-1299489142
                                                                            • Opcode ID: cc51c9c2469bf6088fd9a0ac4857e4e5741a6f3463e752394b9c224d772c5d54
                                                                            • Instruction ID: 7f71f2e701e31c8eeb798e882782c03ade72d2d669d77aafdc4f634b9190f3ba
                                                                            • Opcode Fuzzy Hash: cc51c9c2469bf6088fd9a0ac4857e4e5741a6f3463e752394b9c224d772c5d54
                                                                            • Instruction Fuzzy Hash: 4341DA31F4F742A2FB549B25A8402393290EF587D4F148138DA5E07B95EF3DE452D729
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8805D50 Relevance: 13.7, APIs: 9, Instructions: 245windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CompositionContextProcStringWindow$CountMessageReleaseSendTick
                                                                            • String ID:
                                                                            • API String ID: 4008441895-0
                                                                            • Opcode ID: ff085adabb561743047a4ef4701becfe351342b6efb8f6f8758746e34f8ec804
                                                                            • Instruction ID: a0aedd6fc70049fa6a760e01c7a9d64db3f2880dff7c3ee491eacf05f0abd807
                                                                            • Opcode Fuzzy Hash: ff085adabb561743047a4ef4701becfe351342b6efb8f6f8758746e34f8ec804
                                                                            • Instruction Fuzzy Hash: E7A1CC32F0AB4296E710DB6A94442BD22B1FB88BC5F144175DE5E837A9EF3CE4518728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87359C0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 249COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            • memcpy.VCRUNTIME140 ref: 00007FF8A8735BE5
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Heap$AllocAllocateErrorLastProcessValuememcpy
                                                                            • String ID: unable to alloc %u bytes
                                                                            • API String ID: 622497690-2759121943
                                                                            • Opcode ID: 4e5ec02c436f21af49f43cda60ce369ddf87ddc33e213c73fd08cf95071b5702
                                                                            • Instruction ID: 1a63965a711eb8649b4463fac1dec4168cd513beb36a02f75a9af3bcbaa1893c
                                                                            • Opcode Fuzzy Hash: 4e5ec02c436f21af49f43cda60ce369ddf87ddc33e213c73fd08cf95071b5702
                                                                            • Instruction Fuzzy Hash: 32B1D032A4AB8296EB608F25E44437A73A1FB88BD8F188135DE8D47798DF3CE441C755
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87FD9B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 112registrywindowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: HandleLoadModule$ClassCursorIconRegister
                                                                            • String ID: TkTopLevel$Unable to register TkTopLevel class
                                                                            • API String ID: 1220223050-2494010311
                                                                            • Opcode ID: c0923999ed4cc9b7338c188408aeeb62c0a2598192d10c4c95110e9482fa82c4
                                                                            • Instruction ID: 3ec6d62fa3b1f6e5ad73611151af0830003d11368b4cea8e93cd7d60215bc1f7
                                                                            • Opcode Fuzzy Hash: c0923999ed4cc9b7338c188408aeeb62c0a2598192d10c4c95110e9482fa82c4
                                                                            • Instruction Fuzzy Hash: 3F519031A0AB46E2EB10CF11E4442793BA0FB84BC5F54417ADA9E03764DFBCE981C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8693A60 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 301COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00007FF8A8703A00: TlsAlloc.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703A0D
                                                                              • Part of subcall function 00007FF8A8703A00: TlsGetValue.KERNEL32 ref: 00007FF8A8703A3B
                                                                              • Part of subcall function 00007FF8A8703A00: GetLastError.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703A49
                                                                              • Part of subcall function 00007FF8A8703A00: LeaveCriticalSection.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703AEB
                                                                              • Part of subcall function 00007FF8A8703A00: GetProcessHeap.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703AFF
                                                                              • Part of subcall function 00007FF8A8703A00: HeapAlloc.KERNEL32(?,?,?,?,00007FF8A8633181), ref: 00007FF8A8703B10
                                                                            • memcpy.VCRUNTIME140 ref: 00007FF8A8693B84
                                                                            • LeaveCriticalSection.KERNEL32 ref: 00007FF8A8693C0C
                                                                            • LeaveCriticalSection.KERNEL32 ref: 00007FF8A8693E5C
                                                                            • LeaveCriticalSection.KERNEL32 ref: 00007FF8A8693E90
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CriticalLeaveSection$AllocHeap$ErrorLastProcessValuememcpy
                                                                            • String ID: FreeEncoding: refcount problem !!!$concurrent dictionary modification and search$unable to alloc %u bytes
                                                                            • API String ID: 1241236031-687981174
                                                                            • Opcode ID: 3493600043e21a1512b6d10364d45e8bd0a3784bc7d8db27c902ad6dd0f55e7d
                                                                            • Instruction ID: 6657df918a9c216ce51a201e57040a8f3605d04117cf16da1f352a168f8e4b07
                                                                            • Opcode Fuzzy Hash: 3493600043e21a1512b6d10364d45e8bd0a3784bc7d8db27c902ad6dd0f55e7d
                                                                            • Instruction Fuzzy Hash: 9BD18672A0AE42A6FB549B25E6882B933A1FB44BD4F446135CE0E437D4DF3CE456C368
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A873E7F0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 207COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CriticalLeaveSection
                                                                            • String ID: FreeEncoding: refcount problem !!!$PGV Initializer did not initialize$unable to alloc %u bytes
                                                                            • API String ID: 3988221542-1397560407
                                                                            • Opcode ID: 7c8e5aaf74f2455e9eee001f38c9032c3b8fe7e75cd85dc6da68d11caa949828
                                                                            • Instruction ID: 43eaa0092d6a0a92850d6a2156950695daa09378c1c5d2a04b2313be32455ebe
                                                                            • Opcode Fuzzy Hash: 7c8e5aaf74f2455e9eee001f38c9032c3b8fe7e75cd85dc6da68d11caa949828
                                                                            • Instruction Fuzzy Hash: 5081B132A4BA46A6EA54EB21E4502B933A0FF84BC0F448435DF1E47B96DF3CE561C365
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88053C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 196windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ClientLongMovePlacementRectVisible
                                                                            • String ID: ,
                                                                            • API String ID: 2284278383-3772416878
                                                                            • Opcode ID: fec93ba8e8cb3e46e73ddd7a2b334128f749a3711153143432947e657c33fd0b
                                                                            • Instruction ID: 8777e2b096e121f7c68c76c5115954c5b03199b7ed2b632473fa2b486bba6253
                                                                            • Opcode Fuzzy Hash: fec93ba8e8cb3e46e73ddd7a2b334128f749a3711153143432947e657c33fd0b
                                                                            • Instruction Fuzzy Hash: 1AA13772B06682ABE768CF39C544B6C77B0FB48B94F044175DA5D97658CF38E860CB24
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F3F80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 138COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ObjectSelect$FaceTextmemset
                                                                            • String ID: unicode$utf-16
                                                                            • API String ID: 920176757-3317161374
                                                                            • Opcode ID: 0ef7dd9b9b51d631bdd2aeaee7c11b4b5063e5093dfbb883ad80748d58dbe8de
                                                                            • Instruction ID: 08824a619ee998636f0d4711401ec84881a5a4c507965a7e192c263a3e73a70a
                                                                            • Opcode Fuzzy Hash: 0ef7dd9b9b51d631bdd2aeaee7c11b4b5063e5093dfbb883ad80748d58dbe8de
                                                                            • Instruction Fuzzy Hash: 62515E76B06B5AA2EB14CB12E8443AA73A1FB48BD1F048135DE5D47794EF7CE460C354
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E68F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Window$CreateHandleLongModule
                                                                            • String ID: BUTTON$STATIC
                                                                            • API String ID: 4115577067-3385952364
                                                                            • Opcode ID: 857e6716b15ef4890199d9618cffe4b0cb858dea5ec010925580daf5bbc2fd1a
                                                                            • Instruction ID: 94a5c08bd63a16a3596b8a5b8862b4a6859a8bc7f6650a1d16715e90e4e246e8
                                                                            • Opcode Fuzzy Hash: 857e6716b15ef4890199d9618cffe4b0cb858dea5ec010925580daf5bbc2fd1a
                                                                            • Instruction Fuzzy Hash: 5F313736609B829BD750CF25E840A5AB7E4F788B98F144139EA8D93B28DF3CD4518B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A86B92A0 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 195memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetProcessHeap.KERNEL32(?,?,?,00007FF8A86B8A5C,?,?,tclPackageAboutDict,00007FF8A8627562,Unable to create query command for package configuration,?,?,00007FF8A8685D4C,?,?,00000000,00007FF8A868581C), ref: 00007FF8A86B932B
                                                                            • HeapAlloc.KERNEL32(?,?,?,00007FF8A86B8A5C,?,?,tclPackageAboutDict,00007FF8A8627562,Unable to create query command for package configuration,?,?,00007FF8A8685D4C,?,?,00000000,00007FF8A868581C), ref: 00007FF8A86B9339
                                                                            • memset.VCRUNTIME140(?,?,?,00007FF8A86B8A5C,?,?,tclPackageAboutDict,00007FF8A8627562,Unable to create query command for package configuration,?,?,00007FF8A8685D4C,?,?,00000000,00007FF8A868581C), ref: 00007FF8A86B9355
                                                                            • GetProcessHeap.KERNEL32(?,?,?,00007FF8A86B8A5C,?,?,tclPackageAboutDict,00007FF8A8627562,Unable to create query command for package configuration,?,?,00007FF8A8685D4C,?,?,00000000,00007FF8A868581C), ref: 00007FF8A86B940C
                                                                            • HeapFree.KERNEL32(?,?,?,00007FF8A86B8A5C,?,?,tclPackageAboutDict,00007FF8A8627562,Unable to create query command for package configuration,?,?,00007FF8A8685D4C,?,?,00000000,00007FF8A868581C), ref: 00007FF8A86B941A
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Heap$Process$AllocFreememset
                                                                            • String ID: unable to alloc %u bytes
                                                                            • API String ID: 2653029805-2759121943
                                                                            • Opcode ID: 192122186d75ce5b94655e133541cd2fdc4908fc8419120ae40a33b51a9bd870
                                                                            • Instruction ID: e4b654d47700ff60dde53ccce7df3fda48c3031acddf9d391a268ae88d62d8e3
                                                                            • Opcode Fuzzy Hash: 192122186d75ce5b94655e133541cd2fdc4908fc8419120ae40a33b51a9bd870
                                                                            • Instruction Fuzzy Hash: 5271D232A5A642AAF754DB25E48837933A0FB45BD8F146035DA1E83BD1EF3CE861C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A885B850 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 94COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset$_stricmp
                                                                            • String ID: IMAGE$PNG$ZLIB_INIT$zlib initialization failed
                                                                            • API String ID: 3026489053-4061978001
                                                                            • Opcode ID: d0bb1f1f8d9ea6f17d2a869987b9b07d186b5bbe820d6441cc0d377e36fa2ca5
                                                                            • Instruction ID: 47825d9457880eb000b652c6777040b28fe5e27355e544161a805eaca88aaea6
                                                                            • Opcode Fuzzy Hash: d0bb1f1f8d9ea6f17d2a869987b9b07d186b5bbe820d6441cc0d377e36fa2ca5
                                                                            • Instruction Fuzzy Hash: F341AF72B0AA8696EB24CB12E4443BA73A1FB88BC5F044135DA4D47B94EF3CD545CB18
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87EEAF0 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeRealizeSelect
                                                                            • String ID:
                                                                            • API String ID: 3073415821-0
                                                                            • Opcode ID: 8faf9f438d025fe2bd8a4773709f3ddb629765b6099fa91ef73b37f93b971014
                                                                            • Instruction ID: 4f4d6c4b2dd835694d63dae2b0b2099b60968f24b35a960c3009a6520b6a365a
                                                                            • Opcode Fuzzy Hash: 8faf9f438d025fe2bd8a4773709f3ddb629765b6099fa91ef73b37f93b971014
                                                                            • Instruction Fuzzy Hash: 10314A26B0AB81D2DB54DF16E88426DA360F749FC5F185432DE4E47768EF3CD4918314
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B7E70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ColorLongProc
                                                                            • String ID: #%04X%04X%04X$Ttk
                                                                            • API String ID: 3223664542-2938447076
                                                                            • Opcode ID: 99c4d10d1e3fcec791e8b38746ad7f391361fda9ffe284d98070eef17f4e401c
                                                                            • Instruction ID: bbf8367ffa2cf1cc65340f090c1b9123c6c3ff1695052e3965c4f68f53ff4556
                                                                            • Opcode Fuzzy Hash: 99c4d10d1e3fcec791e8b38746ad7f391361fda9ffe284d98070eef17f4e401c
                                                                            • Instruction Fuzzy Hash: F241CC36B0AB8692E7508B16E80476A73A1FB84BC6F444036EE8D077A8DF3DE055CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8683770 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 345stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000001,00007FF8A86225F8,?,?,?,?,?,?,?,?,00000001,?,?,00007FF8A862085F), ref: 00007FF8A86837FF
                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000001,00007FF8A86225F8,?,?,?,?,?,?,?,?,00000001,?,?,00007FF8A862085F), ref: 00007FF8A868384F
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: unable to alloc %u bytes$unable to realloc %u bytes
                                                                            • API String ID: 1114863663-3519456369
                                                                            • Opcode ID: b91ac0882488f59c72aef983f4f6b72df2d641f154db80b68eb99ff96d38438c
                                                                            • Instruction ID: 32352d7d3fb00136920434d8d77075791f7880d9b7761d0cc37561f7deb2614f
                                                                            • Opcode Fuzzy Hash: b91ac0882488f59c72aef983f4f6b72df2d641f154db80b68eb99ff96d38438c
                                                                            • Instruction Fuzzy Hash: E6D1EFB2B0AB41A6EB109F16E68867973A4FB44BC4F155535CE5D47794EF3CE802C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A86C7630 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 320COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Valuememcpy
                                                                            • String ID: binary encoding is not available$iso8859-1$unable to alloc %u bytes
                                                                            • API String ID: 574835123-1438692910
                                                                            • Opcode ID: b19d542b56b77b43a231081654c229985e4490c9c7776260fb51ba4f6b8d0d37
                                                                            • Instruction ID: c343140976dc44c4506e5b6e3dd1118f09537673f4ef166ec88e45dd380281f0
                                                                            • Opcode Fuzzy Hash: b19d542b56b77b43a231081654c229985e4490c9c7776260fb51ba4f6b8d0d37
                                                                            • Instruction Fuzzy Hash: 4FE1AF72A0AB8196E760CF19E848AAA73B4FB88B84F558135DF8D83748DF3CD454CB54
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A861D510 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 298COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A861D554
                                                                            • memset.VCRUNTIME140 ref: 00007FF8A861D5A0
                                                                            • memset.VCRUNTIME140 ref: 00007FF8A861D71B
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            • memcpy.VCRUNTIME140 ref: 00007FF8A861D8E8
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: HeapValuememset$AllocAllocateErrorLastProcessmemcpy
                                                                            • String ID: unable to alloc %u bytes
                                                                            • API String ID: 1198791097-2759121943
                                                                            • Opcode ID: 586010a6622b4d0b1ddc080cf53a9d2cc0a485280e313ae8d73c2d023208aeab
                                                                            • Instruction ID: 92b866b311f6744058e5e18ab1539b43611d3c257515d4592604334c73261c58
                                                                            • Opcode Fuzzy Hash: 586010a6622b4d0b1ddc080cf53a9d2cc0a485280e313ae8d73c2d023208aeab
                                                                            • Instruction Fuzzy Hash: 60C1B072A0AB42A1FB64DF95E0482B967A0FB84BD8F445531DE5D07796DF3CE840C368
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88148A0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 273COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: DeleteObject
                                                                            • String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup$gray50
                                                                            • API String ID: 1531683806-823200916
                                                                            • Opcode ID: 719325626fab47a85f70baaa3eb835210efcf709a9d2012c85b3d6e5dea24c8d
                                                                            • Instruction ID: a8c106f755e94404b33f38f45cffb74102c6c6a022e1ddf613e4efce93db5d04
                                                                            • Opcode Fuzzy Hash: 719325626fab47a85f70baaa3eb835210efcf709a9d2012c85b3d6e5dea24c8d
                                                                            • Instruction Fuzzy Hash: BDE132B2B06B858AEB10CF65D4843AC33A5FB48B88F05813ADE4C5BB98DF78D495C754
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F3DA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: DeleteObject
                                                                            • String ID: unicode$utf-16
                                                                            • API String ID: 1531683806-3317161374
                                                                            • Opcode ID: c60797b1542d4fd6972a4b2a454828e70e554c962c1ccce3523fcd8e462a9309
                                                                            • Instruction ID: b04fcdd7f8c871adfd70d3c81b4299aa5f978a962c70303feaa4f073ce719951
                                                                            • Opcode Fuzzy Hash: c60797b1542d4fd6972a4b2a454828e70e554c962c1ccce3523fcd8e462a9309
                                                                            • Instruction Fuzzy Hash: 03514A36B0BB4AE2EB588B16D44423977A0FB48FC1F49443ACA5D03760DFB9E860C314
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87FD0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Window$CreateHandleModule
                                                                            • String ID: TkChild
                                                                            • API String ID: 1084761317-227893619
                                                                            • Opcode ID: 7a62c55992fbcbf6ed3e4b251bfeaaffb2160c89fa5d2e0555a0a13e8e40b345
                                                                            • Instruction ID: 7d270ae7e8a82ec478b03ff2374d1d550b5cae1607e93dd7846a0905adf3a02e
                                                                            • Opcode Fuzzy Hash: 7a62c55992fbcbf6ed3e4b251bfeaaffb2160c89fa5d2e0555a0a13e8e40b345
                                                                            • Instruction Fuzzy Hash: 34211B76A097858BE760CF29E48461ABBE1F748BD4F185139EB8943B28DF7CE441CB04
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A86EF1A0 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 353COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00007FF8A87308B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AC1
                                                                              • Part of subcall function 00007FF8A87308B0: TlsGetValue.KERNEL32 ref: 00007FF8A8730AEF
                                                                              • Part of subcall function 00007FF8A87308B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730AFD
                                                                              • Part of subcall function 00007FF8A87308B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A87200D6,?,?,00000000,00007FF8A87223CD), ref: 00007FF8A8730B3B
                                                                              • Part of subcall function 00007FF8A87308B0: RtlAllocateHeap.NTDLL ref: 00007FF8A8730B49
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A86EF51B
                                                                            • TlsGetValue.KERNEL32 ref: 00007FF8A86EF5F9
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Value$Heap$AllocAllocateErrorLastProcess
                                                                            • String ID: ::oo::Obj%d$unable to alloc %u bytes
                                                                            • API String ID: 1174234723-2182450095
                                                                            • Opcode ID: d7bc3520034bd2a8814551bd0f5dcd9aacbba0c26dff353d6a960344e42a12ea
                                                                            • Instruction ID: 9b0955125e8368700b9c8db9099ad142205a0e984f96f42e19c5cc228da55c29
                                                                            • Opcode Fuzzy Hash: d7bc3520034bd2a8814551bd0f5dcd9aacbba0c26dff353d6a960344e42a12ea
                                                                            • Instruction Fuzzy Hash: 2EE16532A0AB42A6EB45DF15E4543A933A0FB98BC4F089136DA4E477A5EF3CE451C364
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8764B10 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CommConsoleErrorFileLastModeStateType
                                                                            • String ID:
                                                                            • API String ID: 3984557487-0
                                                                            • Opcode ID: df3899ba5c7bcf4194486d8c598b4dcc5bcbbffe54da283f66fc9673edaa1001
                                                                            • Instruction ID: a6ce8e557198c45759e4783444a5420f9b4785292189fb6a7e26166d75128501
                                                                            • Opcode Fuzzy Hash: df3899ba5c7bcf4194486d8c598b4dcc5bcbbffe54da283f66fc9673edaa1001
                                                                            • Instruction Fuzzy Hash: 3601842074E601A6F7108B25E84033A73A5FF89BD4F480138DA5E83654EF2CD484CB68
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A86D3D30 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _errno
                                                                            • String ID: ctory$unable to alloc %u bytes
                                                                            • API String ID: 2918714741-474272330
                                                                            • Opcode ID: 93e56f16bb5935fa2ae65139d102f1d0726e3976824b4d904fa6933d60dcb7a4
                                                                            • Instruction ID: bf9bd8cca719b370e88c4de9ed5b2d061876165bfd3a31433fdc0d6eaf340bd8
                                                                            • Opcode Fuzzy Hash: 93e56f16bb5935fa2ae65139d102f1d0726e3976824b4d904fa6933d60dcb7a4
                                                                            • Instruction Fuzzy Hash: 2AA1E022A0EB46A6FA148F25E54827967A0FF84BC4F045135DE4D437A1EF3CE885CB68
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A885DCE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CreateDeleteIndirectObjectRectstrncmp
                                                                            • String ID: tried to delete photo image when instances still exist
                                                                            • API String ID: 3169462253-2722655475
                                                                            • Opcode ID: 3b73d777d39f39ede53361599a6c2ef680884c6c6a9d3983f23c5625f1f00c17
                                                                            • Instruction ID: aa77eeb3f792d7cb50089230d66f621d340d42f64993aa54198f2de759e802d8
                                                                            • Opcode Fuzzy Hash: 3b73d777d39f39ede53361599a6c2ef680884c6c6a9d3983f23c5625f1f00c17
                                                                            • Instruction Fuzzy Hash: 90517C76B1AB4692EA14CF22E848A7933A5FB98BC1F0A5675CE0D07724DF78E590C314
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8680040 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 205stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: ::tcl$::tcl::
                                                                            • API String ID: 1114863663-1364682314
                                                                            • Opcode ID: d773318f654be096673ec8183b1b78813771f3c0630f1d80ba15fd5b0625eac9
                                                                            • Instruction ID: 95dff19e2dd0f67fdcbe958c66f5dd9444dab538f63aa64a30a67891eb61e161
                                                                            • Opcode Fuzzy Hash: d773318f654be096673ec8183b1b78813771f3c0630f1d80ba15fd5b0625eac9
                                                                            • Instruction Fuzzy Hash: 0A91AE32B0AB8196EB50CF65E4846AD77A0FB89BC4F441436DE8D47B58EF38D941CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8805E10 Relevance: 4.6, APIs: 3, Instructions: 126COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: LongWindow
                                                                            • String ID:
                                                                            • API String ID: 1378638983-0
                                                                            • Opcode ID: de7c3142df15802711a77df211f90b19db5808617cda21bf7a862613cbf31ce6
                                                                            • Instruction ID: c6c85808071b98170d119aec45ce57ece44ca1a3f18ed97c195cb44af058a0bf
                                                                            • Opcode Fuzzy Hash: de7c3142df15802711a77df211f90b19db5808617cda21bf7a862613cbf31ce6
                                                                            • Instruction Fuzzy Hash: 7C51AE36B0A782A6E724CF51E4442B977B1FB84BD5F184135EA8D13B68CF7CE4448724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88061A6 Relevance: 4.6, APIs: 3, Instructions: 83windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: FocusMessageProcSendWindow
                                                                            • String ID:
                                                                            • API String ID: 1049918876-0
                                                                            • Opcode ID: d9164bf8fc9927836ba4ef06716c2d5649523429fcf7e64b499289219d0004ec
                                                                            • Instruction ID: 96ca89a2ccddc8f7d18f2ed95e3cfbdb8fa88da09f6872e0877ae51a04907d27
                                                                            • Opcode Fuzzy Hash: d9164bf8fc9927836ba4ef06716c2d5649523429fcf7e64b499289219d0004ec
                                                                            • Instruction Fuzzy Hash: 13314A32B0AB46A6EB64DF55D4802B863B1FB84BE5F140176DA4D03B94DF3DE8958328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8813610 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 194COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetSystemMetrics.USER32 ref: 00007FF8A881364A
                                                                              • Part of subcall function 00007FF8A87E6890: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A87E68DB
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MetricsSystem__stdio_common_vsprintf
                                                                            • String ID: pathName ?-option value ...?
                                                                            • API String ID: 2968932569-1831586811
                                                                            • Opcode ID: f47597e142e0fa90eb1e78a9802fddc0930041b2e9279b8d311ee2c2a9bb543c
                                                                            • Instruction ID: e3e63062440ebbe95c9cd449e95467785c8b3ee63a78bb0f3404476ea8c841d3
                                                                            • Opcode Fuzzy Hash: f47597e142e0fa90eb1e78a9802fddc0930041b2e9279b8d311ee2c2a9bb543c
                                                                            • Instruction Fuzzy Hash: 69A1157AA06B8195D740DF21F9443AA33A8F744F8CF584139DE890B318DF78D0A9E368
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A863BD40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: name
                                                                            • API String ID: 0-1579384326
                                                                            • Opcode ID: 0ff29cf7af045aba3352e728221fb159f4cf0e13e58a0aeee67cd01ed567dbb8
                                                                            • Instruction ID: f9e4b7f3f620a89384113d17ffb89d2188b3cd6a8ba84ac697ed48ad291a9ddf
                                                                            • Opcode Fuzzy Hash: 0ff29cf7af045aba3352e728221fb159f4cf0e13e58a0aeee67cd01ed567dbb8
                                                                            • Instruction Fuzzy Hash: 01110661F0E642A1FB549F26A8452BA16A1DF49BD0F846130ED0E477C2DF2CD5818364
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E8390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: ButtonProc called on an invalid HWND
                                                                            • API String ID: 0-237202145
                                                                            • Opcode ID: 0be62edd70a93127788975da0d3d16b0fba35739c56e52aee4b2d0086fbc6ad7
                                                                            • Instruction ID: cbbf923fcc14523219c73b7f59051e70fb987b624dc861be428c6b21fe8d4536
                                                                            • Opcode Fuzzy Hash: 0be62edd70a93127788975da0d3d16b0fba35739c56e52aee4b2d0086fbc6ad7
                                                                            • Instruction Fuzzy Hash: 6E112322B0AA85A7EA148B17E8503B96361FF88FC5F084031EE4D07755EF3CE4528318
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A86C8130 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 213COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: Buffer Underflow, BUFFER_PADDING not enough
                                                                            • API String ID: 0-3280121635
                                                                            • Opcode ID: 8dd504d38ad0c54b9cea606a11ef04abcbdd2436c230b80057357f16f8e18235
                                                                            • Instruction ID: 41705528210483a19e3559ddc0247c1ef6ca7cd29ed975c32388f7cad7911afe
                                                                            • Opcode Fuzzy Hash: 8dd504d38ad0c54b9cea606a11ef04abcbdd2436c230b80057357f16f8e18235
                                                                            • Instruction Fuzzy Hash: A1819AB2B05A419AEB60CFA9D8447AD33B1FB44798F141135EF4DA7B48DB38E415CB44
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8720A10 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 82COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • memmove.VCRUNTIME140(00000000,00000000,00000000,00007FF8A872083A,?,?,00000000,00007FF8A8680F76,?,?,?,?,?,00007FF8A8683B51), ref: 00007FF8A8720ACD
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302558722.00007FF8A8611000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8A8610000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302529590.00007FF8A8610000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302678347.00007FF8A877C000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302724635.00007FF8A87C5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302754404.00007FF8A87C8000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a8610000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memmove
                                                                            • String ID: max size for a Tcl value (%d bytes) exceeded
                                                                            • API String ID: 2162964266-746697796
                                                                            • Opcode ID: 3d54c99d1ee26e2d90630fa92c230f6e633da87b05812106973fc2f82085c46d
                                                                            • Instruction ID: 993ce3757133104ebc204fe7f27fc2c01a742480ebb49ebc7f02426ece1d1d7f
                                                                            • Opcode Fuzzy Hash: 3d54c99d1ee26e2d90630fa92c230f6e633da87b05812106973fc2f82085c46d
                                                                            • Instruction Fuzzy Hash: 8621F332A4A75192EB148F159544239B7B1FB41BE0F548231DE6C17B85FF7CE80187A8
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887BC70 Relevance: 2.7, APIs: 2, Instructions: 209stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strchrstrncpy
                                                                            • String ID:
                                                                            • API String ID: 3824778938-0
                                                                            • Opcode ID: 3dd70e91cda7659e9fea90a2ba97e073655cc70a8f0590d3b4eb06a0e165f3c5
                                                                            • Instruction ID: 2a4cc9bbf070536aff581d1b19b61378691d63e3ffacd0a2403eb834fbead67f
                                                                            • Opcode Fuzzy Hash: 3dd70e91cda7659e9fea90a2ba97e073655cc70a8f0590d3b4eb06a0e165f3c5
                                                                            • Instruction Fuzzy Hash: 11818A36B06A86A6EB64CF1AD45066937A2FF88BC8F448431DE0E47796DF38E851C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E21F Relevance: 1.6, APIs: 1, Instructions: 87COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: 4911f0a28e7803ce05eb3c3fd46f6b1717d95dda70f613d60b19da599f6e0b21
                                                                            • Instruction ID: 6d4a14a7cf866487b3d62db2f1558ec45d9743e0b6fdbf63721b50ad502c2644
                                                                            • Opcode Fuzzy Hash: 4911f0a28e7803ce05eb3c3fd46f6b1717d95dda70f613d60b19da599f6e0b21
                                                                            • Instruction Fuzzy Hash: 0E414476B1A686CADB60DF2AE04476E7BB1F788F84F044166DE8D03B58CF39E4448B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B6135 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 9c4c2904de79a5311d24a280db9180121a06792ce8bc52dd813d60a93972c109
                                                                            • Instruction ID: 77c69b66d6311de3b7f688f886c3154f2c72e78fb353d6d431455e7c5fbb6ea6
                                                                            • Opcode Fuzzy Hash: 9c4c2904de79a5311d24a280db9180121a06792ce8bc52dd813d60a93972c109
                                                                            • Instruction Fuzzy Hash: 50415672A0A68A99EB64DF95D4547AC27A1EB84FC8F08807ADE0D4739ADF38D440C764
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E1EB Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: fb973755855921c49ea009edfb8105a3fe002e71d366de990dd2e27bd21ebc32
                                                                            • Instruction ID: e502325a96381507f6abd8e245a8b263bdba8a6db2220717b723f53a0527967f
                                                                            • Opcode Fuzzy Hash: fb973755855921c49ea009edfb8105a3fe002e71d366de990dd2e27bd21ebc32
                                                                            • Instruction Fuzzy Hash: 2C415676B1A686CADB60DF2AE04476E7BB0F784F84F045166EE8D03B58CF39E4448B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E193 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: e60b3387ca4243a11a3bcc3ea155524de45cd22b7f91fe754d4457b4bfeb6f9a
                                                                            • Instruction ID: 2a82cab061873e109235f3af0c3ff01be8127f9a666c6d853ff1bd12cf8331ec
                                                                            • Opcode Fuzzy Hash: e60b3387ca4243a11a3bcc3ea155524de45cd22b7f91fe754d4457b4bfeb6f9a
                                                                            • Instruction Fuzzy Hash: 57414576B1A686CADB60EF2AE04476E7BB0F784F84F044166DE8D03B58CF79E4448B54
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E203 Relevance: 1.6, APIs: 1, Instructions: 81COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: 459f35d279bd8c45caafa607da81928978591b2944f4e549aad2b0735bc0abe2
                                                                            • Instruction ID: 0d2e3c1f911198c576721ec6fb2956541cc8188f753ccf90a3d7080eee4b29a2
                                                                            • Opcode Fuzzy Hash: 459f35d279bd8c45caafa607da81928978591b2944f4e549aad2b0735bc0abe2
                                                                            • Instruction Fuzzy Hash: B8413576B1A686DADB60DF2AE04476E7BB0F784F84F144166DE8D03B58CF39E4448B24
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E1C4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: b107912ecb7703b7f4f8086364d5e95efbd84f3f6691e9fa9a7f2f763fe2fdf7
                                                                            • Instruction ID: ddc232e85d13594d61095be80844e6b3f4bc4e0e66da0539c891d7d33b890607
                                                                            • Opcode Fuzzy Hash: b107912ecb7703b7f4f8086364d5e95efbd84f3f6691e9fa9a7f2f763fe2fdf7
                                                                            • Instruction Fuzzy Hash: 9D415876B1A686CADB60EF2AE04476E7BB0F784F84F044066DE8C03B58CF79E4408B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E14A Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: 46a8d9ea1bc5145237d1fce1764347139f80a44a88ab74726dddea1a63f867f1
                                                                            • Instruction ID: fba3688729847060039abd00adae098a807f69f29e46703f8d0432629528d8a2
                                                                            • Opcode Fuzzy Hash: 46a8d9ea1bc5145237d1fce1764347139f80a44a88ab74726dddea1a63f867f1
                                                                            • Instruction Fuzzy Hash: 75411576B1A686DADB60DF2AE04436E7BB1F784F84F044166DE4D03758CF79E4448B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E1FE Relevance: 1.6, APIs: 1, Instructions: 78COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: b7820c5a66862acbb6db251366e60bce84ca2ca6bd1a0acc745d3924a5aaf1f3
                                                                            • Instruction ID: b3a872e0d76f046f41c5ec972b06a21586ee1661e84b43d8a1c7cafdd120abb4
                                                                            • Opcode Fuzzy Hash: b7820c5a66862acbb6db251366e60bce84ca2ca6bd1a0acc745d3924a5aaf1f3
                                                                            • Instruction Fuzzy Hash: 28413876B1A686DADB60DF2AE04476D7BB0F784F84F145066DE8D03B58CF39E4448B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E172 Relevance: 1.6, APIs: 1, Instructions: 77COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: 40ff745fc1f09d94547f16d68362dfbc8a4b850974221cde2f3ed35375117db1
                                                                            • Instruction ID: fcc005e00e61783996fcac72c62a41ae7a7bca0b03271eaee1e371fba6386c34
                                                                            • Opcode Fuzzy Hash: 40ff745fc1f09d94547f16d68362dfbc8a4b850974221cde2f3ed35375117db1
                                                                            • Instruction Fuzzy Hash: F1313676B1A686DADB60EF2AE04436E7BB0F784F84F044066EE8D03758CF79E4448B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87FD260 Relevance: 1.6, APIs: 1, Instructions: 77COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ShowWindow
                                                                            • String ID:
                                                                            • API String ID: 1268545403-0
                                                                            • Opcode ID: a816552e71fadee9afb63e3e519801a83d88db330619432cb018bf26502ad68b
                                                                            • Instruction ID: 2f59e8553b2dea25bf0dc7d2b7b8cb614cade7b9192e5c853db2fa0f6c819ddc
                                                                            • Opcode Fuzzy Hash: a816552e71fadee9afb63e3e519801a83d88db330619432cb018bf26502ad68b
                                                                            • Instruction Fuzzy Hash: B9314E7265968596EB64CF15E0843AABBE0FB88B88F084135DF8D47759EF7CD880CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887E208 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MoveWindow
                                                                            • String ID:
                                                                            • API String ID: 2234453006-0
                                                                            • Opcode ID: 2e8582581259a5ba1b10dacbf0509a27312d8bd5f5fc29fd5a22ce8dfaef165c
                                                                            • Instruction ID: a27030fc1e8c7185700216c80eab114872c2b0a3614797271050ea6e847255de
                                                                            • Opcode Fuzzy Hash: 2e8582581259a5ba1b10dacbf0509a27312d8bd5f5fc29fd5a22ce8dfaef165c
                                                                            • Instruction Fuzzy Hash: E8312676B1A686DADB60EF2AE04436E7BB0FB84F94F045066DE4D03758CF79E4448B24
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87FF4D0 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: HandleLoadModule$ClassCursorIconRegisterShowWindow
                                                                            • String ID:
                                                                            • API String ID: 3163394910-0
                                                                            • Opcode ID: f90de97afad66ea11c02e709b31a7bec116550207db85d13ab11c4fe6dd1f453
                                                                            • Instruction ID: 4c126add6964554412d525bab11f7e19f9620ab3dba4e77ee30c867fa1954b3b
                                                                            • Opcode Fuzzy Hash: f90de97afad66ea11c02e709b31a7bec116550207db85d13ab11c4fe6dd1f453
                                                                            • Instruction Fuzzy Hash: 1221A932E4A68A91E764CF26D0843BD2761EB48BD4F184035DA0D4B395DFB8DDC1C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A887CB20 Relevance: 1.6, APIs: 1, Instructions: 301COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • memcpy.VCRUNTIME140(?,?,?,?,00000008,00000000,000000D0,?,?,00007FF8A887BCC2), ref: 00007FF8A887CE5B
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memcpy
                                                                            • String ID:
                                                                            • API String ID: 3510742995-0
                                                                            • Opcode ID: 1d0ea6f8b58e166b1403f1f5555346340e46a15ebde85784e01d1d1befdaf410
                                                                            • Instruction ID: 5d48119bc8b1feaee7dcefd37b5c7ffbb2326b7bf7c15791361c3f094266b4b3
                                                                            • Opcode Fuzzy Hash: 1d0ea6f8b58e166b1403f1f5555346340e46a15ebde85784e01d1d1befdaf410
                                                                            • Instruction Fuzzy Hash: 2AF12AB7602F45DACB64CF19E4802ADBBB5F788B84B55822ACB4E43720DF38E595C710
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A880B2B0 Relevance: 1.5, APIs: 1, Instructions: 292COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset
                                                                            • String ID:
                                                                            • API String ID: 2221118986-0
                                                                            • Opcode ID: e74d781beeba70443377cc54e8dc89fe99b30deb64ed9bc94750147b23a5e519
                                                                            • Instruction ID: 957e51e744cc9198201b25f6b69ed0ed2372178b7e59bf588e301007c7026947
                                                                            • Opcode Fuzzy Hash: e74d781beeba70443377cc54e8dc89fe99b30deb64ed9bc94750147b23a5e519
                                                                            • Instruction Fuzzy Hash: B5F11171A0A7869AE754CF29E88426533A1FB847A1F58473DE56DC72F0DF3CE8418B18
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87FF600 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ShowWindow
                                                                            • String ID:
                                                                            • API String ID: 1268545403-0
                                                                            • Opcode ID: c0dd2bf71d95c61cf7ebb3dc171792536834da87f5e96c054f4d4db983d86b9c
                                                                            • Instruction ID: 6c3de4c0b8d41ca86e54a2bc0f0df3cb6303fcf230bf2034a6aadb8e463c3d65
                                                                            • Opcode Fuzzy Hash: c0dd2bf71d95c61cf7ebb3dc171792536834da87f5e96c054f4d4db983d86b9c
                                                                            • Instruction Fuzzy Hash: F2F09071E4A54A92FB714F1AC4943B93261DBA6B55F38A031C5080E3E8DF79DCC6C729
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Non-executed Functions

                                                                            Function 00007FF8A87F2C00 Relevance: 80.8, APIs: 44, Strings: 2, Instructions: 313windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Text$ObjectSelect$Delete$ColorCreateMode$CompatiblePalette$AlignMetrics$BitmapBrushExtentPointRealize$ClipPatternRelease
                                                                            • String ID: b$unexpected drawable type in stipple
                                                                            • API String ID: 3943515398-268975484
                                                                            • Opcode ID: b4405ffdbca2a76212e8db5cca80c5ef91652ec258bae54aa501eff6a6602e72
                                                                            • Instruction ID: 8ac8a5b24bed87da732c68e49e55d70fcc1e06e0729e0b5c63fd9e9153dd5a07
                                                                            • Opcode Fuzzy Hash: b4405ffdbca2a76212e8db5cca80c5ef91652ec258bae54aa501eff6a6602e72
                                                                            • Instruction Fuzzy Hash: 7DE16C3AB19A419BD710CF22E84456EB7A1FB89BD5F004631EE8957B18EF7CE448CB04
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A886AD10 Relevance: 40.6, APIs: 8, Strings: 15, Instructions: 374stringlibraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Modulestrcmp$AddressFileHandleLibraryLoadNameProcabortstrncmp
                                                                            • String ID: -display$-encoding$-file$8.1$8.6$DISPLAY$Error in startup script$Tk_MainEx$application-specific initialization failed$argc$argv$argv0$env$errorInfo$tcl_interactive
                                                                            • API String ID: 1130958833-3198950010
                                                                            • Opcode ID: 653a0a03edf8f70bb6ebe2aacfa257a8d2d9aac8819086ca14b478ac6293e5c4
                                                                            • Instruction ID: bc6f6ed456de24c2587ef26e262ddcf5c44229664a763b3adc9e87a60c018753
                                                                            • Opcode Fuzzy Hash: 653a0a03edf8f70bb6ebe2aacfa257a8d2d9aac8819086ca14b478ac6293e5c4
                                                                            • Instruction Fuzzy Hash: 67027165B0AB46A2EB149B26D8583BA27A1FF84FC6F084075CE1D077A4DF7DE544C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F0CB0 Relevance: 31.8, APIs: 21, Instructions: 252COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 339819bebf9a97463a444c0196906523f089a25507583fcf99a5a10f00faaabd
                                                                            • Instruction ID: 64c77d0a840fbd7814bba3e5930b53e2dfc9e30a386d116db76ca28bcd52f93b
                                                                            • Opcode Fuzzy Hash: 339819bebf9a97463a444c0196906523f089a25507583fcf99a5a10f00faaabd
                                                                            • Instruction Fuzzy Hash: ACC1E535A18AC18BD326CB35A4056AAB3A5FFD97D1F148336D98693B14EF3CD481CB10
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F8D40 Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 235COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: LOOKUP$NO_MAIN_WINDOW$NULL main window$WINDOW$bad window path name "%s"$window keySym
                                                                            • API String ID: 0-409716519
                                                                            • Opcode ID: 38464c5334a998861204a328f0a3642f7ae38bb6874da13ec12106001f9764f8
                                                                            • Instruction ID: 91d93de0f41431f4d620c5502c0a394ab1c50c251ce8c7f064c9e5a876b684c7
                                                                            • Opcode Fuzzy Hash: 38464c5334a998861204a328f0a3642f7ae38bb6874da13ec12106001f9764f8
                                                                            • Instruction Fuzzy Hash: 81B1E335B09A8691EB608B2AE8447BD63A2FF88BC5F044135DE8E47794EF7CD445C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87ECA30 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 190windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            • Directory '%s' does not exist,please select or enter an existing directory., xrefs: 00007FF8A87ECBD6
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentDirectory$FullMessageNamePathwcsncpywsprintf
                                                                            • String ID: Directory '%s' does not exist,please select or enter an existing directory.
                                                                            • API String ID: 3083990384-878702107
                                                                            • Opcode ID: 27483d7f6ea8f776f62d7264022338543148a422f5d2c959f125f6f79eff54bd
                                                                            • Instruction ID: cf08482d4c8d86b95f6164e4e6ec4bdd6531bda341b9f3c8728b1461e59f6ecc
                                                                            • Opcode Fuzzy Hash: 27483d7f6ea8f776f62d7264022338543148a422f5d2c959f125f6f79eff54bd
                                                                            • Instruction Fuzzy Hash: 9A91B036B19A86A3EB24CF26E8546B92760FB88BC5F444032DE5E03BA4EF7DD544C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F62B0 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 228windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModePixelRealizeReleaseSelectmemset
                                                                            • String ID: ($XGetImage Failure$XGetImage: not implemented for empty bitmap handles$XGetImage: not implemented for format != XYPixmap$XGetImage: not implemented for plane_mask != 1
                                                                            • API String ID: 2805359893-309510434
                                                                            • Opcode ID: f18bac377af9695fe673bdf4c3637c3fa91be71f6c99ad7deaa3d3faf648cbc0
                                                                            • Instruction ID: 4b4445349c98299732714bc195b9acfd8cb5e65f9d2c2cf6b036e9c6b2570bd6
                                                                            • Opcode Fuzzy Hash: f18bac377af9695fe673bdf4c3637c3fa91be71f6c99ad7deaa3d3faf648cbc0
                                                                            • Instruction Fuzzy Hash: DFB1AE76A0AB8596D7209F16F48076AB7B0FB48BC4F504139CA8E43B64DF7CE854CB18
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87EAC50 Relevance: 21.5, APIs: 9, Strings: 3, Instructions: 498windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CountTick$FileNameWindow$CommEnableErrorExtendedLongMessageOpenPeekSave
                                                                            • String ID: FILEDIALOG$INVALID_FILENAME$invalid filename "%s"
                                                                            • API String ID: 1712915689-2150970497
                                                                            • Opcode ID: ba963463807fc62027e1eb3ce30739ce5770e4b13e7c52646ccc5d69762cce0b
                                                                            • Instruction ID: 379dd890caf962236259655751c545a4aced743c5ba025c0364dafc82e796725
                                                                            • Opcode Fuzzy Hash: ba963463807fc62027e1eb3ce30739ce5770e4b13e7c52646ccc5d69762cce0b
                                                                            • Instruction Fuzzy Hash: 64428D36A09B8A96EB258F25D8882BD37B1FB88BC5F444136DE1E137A4EF78D544C314
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8870D30 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 97registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ClassRegister$HandleModule
                                                                            • String ID: $EmbeddedMenuWindowClass$Failed to register embedded menu window class$Failed to register menu window class$MenuWindowClass
                                                                            • API String ID: 1731912960-3560269961
                                                                            • Opcode ID: 3d14b7eaeabd8ac034bb123ce67c0b2b9653c8d22cedbe47adb8ba512c463885
                                                                            • Instruction ID: 37588b1ea21160536f7bdee43a0a7331aa515cbf5008ac5cc218b187c0096fcc
                                                                            • Opcode Fuzzy Hash: 3d14b7eaeabd8ac034bb123ce67c0b2b9653c8d22cedbe47adb8ba512c463885
                                                                            • Instruction Fuzzy Hash: 6C514A35A0BB4BA1EB149B24E84427A33B6FF48BC5F44417AE58D47265EF7CE444C368
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88069C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 62registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Info$CharsetClassCommonControlsInitKeyboardLayoutLocaleRegisterTranslate
                                                                            • String ID: TkChild$Unable to load common controls?!$Unable to register TkChild class
                                                                            • API String ID: 1007792147-1470692908
                                                                            • Opcode ID: 3561d3eafae51d23affd954911f4903f71990b096321273d650509f631d193bb
                                                                            • Instruction ID: 25cadf0ccf18f7558cfa3e56b1bc0c62a3d6894dc52c22422a6ae48e8d541e4d
                                                                            • Opcode Fuzzy Hash: 3561d3eafae51d23affd954911f4903f71990b096321273d650509f631d193bb
                                                                            • Instruction Fuzzy Hash: 9B315C30B1EA46A6F7119F61E85827633A0FF587CAF480179E4CD46660EF7CE644C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88E01DC Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                            • String ID:
                                                                            • API String ID: 313767242-0
                                                                            • Opcode ID: 1046bffea064cf44cf7ac60518c4eb212e1b662660fb28a955a3b2e6e659014b
                                                                            • Instruction ID: 0fb78bf72c69f5555f5d98212a8cfcfa719b7457ee27382e9859471943bd4fb2
                                                                            • Opcode Fuzzy Hash: 1046bffea064cf44cf7ac60518c4eb212e1b662660fb28a955a3b2e6e659014b
                                                                            • Instruction Fuzzy Hash: 61313C76B0AB829AEB608F60E8403ED7361FB84789F444479DA8D47B95EF3CD548C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8832AD0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 147clipboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Clipboard$CloseDataEmptyOpen
                                                                            • String ID: CLIPBOARD$FORMAT_MISMATCH$format "%s" does not match current format "%s" for %s
                                                                            • API String ID: 1836560592-2768785289
                                                                            • Opcode ID: 1a33881a1f1853a3eec37fdb0112565fffe42e16f9b96bf0560e848b316b64c1
                                                                            • Instruction ID: 98137ba343351de320777d0799f2887a3f60993efad6aecca913f8c24ca031eb
                                                                            • Opcode Fuzzy Hash: 1a33881a1f1853a3eec37fdb0112565fffe42e16f9b96bf0560e848b316b64c1
                                                                            • Instruction Fuzzy Hash: C5617A36B0AB86A2DB049F22E4442A977A0FB48FD5F088575DA6D03364CF3CE465C764
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87EA2A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64comlibraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CreateInstance$AddressHandleInitializeModuleProc
                                                                            • String ID: SHCreateItemFromParsingName$shell32.dll
                                                                            • API String ID: 1434079189-2320870614
                                                                            • Opcode ID: 2cf6a667f9e2848429e5edb8d7e004b786e04e3ec6278dba17334d698234826a
                                                                            • Instruction ID: 842bf7e4e7864cc6f81c8cbe98b5340b168e0f7da379e360cc6358917301818c
                                                                            • Opcode Fuzzy Hash: 2cf6a667f9e2848429e5edb8d7e004b786e04e3ec6278dba17334d698234826a
                                                                            • Instruction Fuzzy Hash: 6E312A36B0AA02A3EB10CF25E844169B3A4FF94BC5F444179DA8E43664EF3DE545C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A885A2A0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 289COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: DATA_OVERFLOW$IMAGE$PNG$PNG image data overflow
                                                                            • API String ID: 0-2868080888
                                                                            • Opcode ID: 4c29ba36f1a833971180dd7522324473cccd99f93756cee6b6b48692d3a4eeae
                                                                            • Instruction ID: 5583a5ffed04091915ea6f6a46454c994036ad11dc1561ead1575fbae69d87e7
                                                                            • Opcode Fuzzy Hash: 4c29ba36f1a833971180dd7522324473cccd99f93756cee6b6b48692d3a4eeae
                                                                            • Instruction Fuzzy Hash: 9CC16932B0E5929AE7598F3884943BD7FA1FB45B89F092072DA8A43385DF3DE445C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E8C00 Relevance: 7.6, APIs: 5, Instructions: 122memoryclipboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Global$AllocClipboardDataLockUnlockmemcpy
                                                                            • String ID:
                                                                            • API String ID: 6447982-0
                                                                            • Opcode ID: 50a8738bf70b5d60fc1d4c7a8442eed23c2dad8fa5834f2562ba14d9f4113f81
                                                                            • Instruction ID: 07ac8f02c833f8f83753054c317c07f26ea143e0eaa82af092b172d936447a2d
                                                                            • Opcode Fuzzy Hash: 50a8738bf70b5d60fc1d4c7a8442eed23c2dad8fa5834f2562ba14d9f4113f81
                                                                            • Instruction Fuzzy Hash: AE51B422B0AA8593EF258F25D4543B963A1FB99FC5F488472DA4E073A4EF7CD450C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A888EB80 Relevance: 6.5, APIs: 1, Strings: 3, Instructions: 453COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset
                                                                            • String ID: Selection$TkBTreeLinesTo couldn't find line$TkBTreeLinesTo couldn't find node
                                                                            • API String ID: 2221118986-1902325206
                                                                            • Opcode ID: 2a932f1d105f1319a44fde87f6bbf79068218f41c39f474046a27a4033c55d01
                                                                            • Instruction ID: 520977cf679f8fd46bca4e00d74fead24737ac06dcc25af58483dfdde7f0996b
                                                                            • Opcode Fuzzy Hash: 2a932f1d105f1319a44fde87f6bbf79068218f41c39f474046a27a4033c55d01
                                                                            • Instruction Fuzzy Hash: 0022AF32B0AA82A6EB60DF15D4446AE77A1FB88BC8F094076DE4D47799DF3CE444CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E8DD0 Relevance: 6.0, APIs: 4, Instructions: 23clipboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Clipboard$CloseDataEmptyOpen
                                                                            • String ID:
                                                                            • API String ID: 1836560592-0
                                                                            • Opcode ID: 0d1831ca3752f1e5d1bd58ee01c99eb4f130e0d9bdf7c5599fce52ae015476e1
                                                                            • Instruction ID: bff4e601f7cdb12c0655eb7a7e9cbe01f6c1286dd52093cb2972fa0f0f7bbee9
                                                                            • Opcode Fuzzy Hash: 0d1831ca3752f1e5d1bd58ee01c99eb4f130e0d9bdf7c5599fce52ae015476e1
                                                                            • Instruction Fuzzy Hash: 28F01769A16A0593F7049B61EC882692760FB98F86F499079C94E03365EF7CD889C324
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8844A30 Relevance: 79.0, APIs: 20, Strings: 25, Instructions: 283stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844A6A
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844A82
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844AAA
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844AC2
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844ADA
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844AF2
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844B0A
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844B22
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844B42
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844B65
                                                                            • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844BAA
                                                                            • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844BC7
                                                                            • _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844CAA
                                                                            • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844D34
                                                                            • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844D50
                                                                            • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844D9B
                                                                            • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844E55
                                                                            • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844EAA
                                                                            • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8A8823CF3), ref: 00007FF8A8844EBD
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _stricmp$strcmp$isspace$_strnicmp
                                                                            • String ID: -Roman$Arial$AvantGarde$Bold$Book$Bookman$Courier$Courier New$Demi$Geneva$Helvetica$Italic$Light$Medium$Monaco$New York$NewCenturySchlbk$NewCenturySchoolbook$Oblique$Palatino$Times$Times New Roman$ZapfChancery$ZapfDingbats$itc
                                                                            • API String ID: 2126113721-1508206677
                                                                            • Opcode ID: 38f27fe6ad06c22c9c6d99c02a1951901f39043e996c5a7d6600961863f5f1d3
                                                                            • Instruction ID: 5c76e6443c67f96c1a8aebcbd3dc5a302436d9c27d3ee986803cf8937064530a
                                                                            • Opcode Fuzzy Hash: 38f27fe6ad06c22c9c6d99c02a1951901f39043e996c5a7d6600961863f5f1d3
                                                                            • Instruction Fuzzy Hash: 7AD18022F0FA43A1EB649B1698482782761FF45FD2F8881B5CD1E47794EF6CE945C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8810980 Relevance: 49.4, APIs: 8, Strings: 20, Instructions: 440stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: isspace$isprintstrchrstrncpy
                                                                            • String ID: <Alt_L>$BAD_CHAR$BUTTON$EVENT$KEYSYM$MALFORMED$NON_BUTTON$NON_KEY$PAST_DETAIL$UNMODIFIABLE$bad ASCII character 0x%x$bad button number "%s"$bad event type or keysym "%s"$extra characters after detail in binding$missing ">" in binding$missing ">" in virtual binding$no event type or button # or keysym$specified button "%s" for non-button event$specified keysym "%s" for non-key event$virtual event "<<>>" is badly formed
                                                                            • API String ID: 3781914229-3880376667
                                                                            • Opcode ID: 7ae6e63e65ce4ba104972e4ec8ff37f7db0a9cba0c4dd340105cf26b4a5fb5e4
                                                                            • Instruction ID: d553f8cd130ed520384fe205caba2a3b8d85b84b2e50d4df3a9eada28186b680
                                                                            • Opcode Fuzzy Hash: 7ae6e63e65ce4ba104972e4ec8ff37f7db0a9cba0c4dd340105cf26b4a5fb5e4
                                                                            • Instruction Fuzzy Hash: 3B12AF21F6FA8AA1EB608B21E84437927A0FF44BC5F4941B5D95D433A4DF7CE845C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F8B30 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 142windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ModePalette$DeleteObjectSelect$ColorRealize$BitmapCompatibleCreateLoadReleaseText
                                                                            • String ID:
                                                                            • API String ID: 1475033899-3916222277
                                                                            • Opcode ID: 33306c416681d0770880daa52499e857684fb4a26a55eafa6f18e963fa911cde
                                                                            • Instruction ID: 5d72355a88f47e89b60007c5312166432c06fa96763c705b408df28c873a8016
                                                                            • Opcode Fuzzy Hash: 33306c416681d0770880daa52499e857684fb4a26a55eafa6f18e963fa911cde
                                                                            • Instruction Fuzzy Hash: B9517E3A70968297EB649F26E44466D7361FB88BC1F044135DE8A87B58DF3CE849CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B8C30 Relevance: 33.3, APIs: 18, Strings: 1, Instructions: 92windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Color$Select$Palette$Object$ModeRealizeText$BrushDeleteRelease
                                                                            • String ID: !
                                                                            • API String ID: 929154361-2657877971
                                                                            • Opcode ID: 74db29e47652b0ec1cae5c2bb3b31d901934d4b19b0445aebc86e2175192a1dd
                                                                            • Instruction ID: 101b5842322ed0852f5e929721e20399080e745c7b9bb0d1b349f6a326934496
                                                                            • Opcode Fuzzy Hash: 74db29e47652b0ec1cae5c2bb3b31d901934d4b19b0445aebc86e2175192a1dd
                                                                            • Instruction Fuzzy Hash: E5414F39B0A74597DB109B22E99813D63A1FB89FD2F104075DE8A47B68EF3CE4868714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88C4960 Relevance: 30.2, APIs: 7, Strings: 13, Instructions: 172stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: ENTRY$INDEX$NO_SELECTION$TTK$bad entry index "%s"$end$insert$left$right$sel.$sel.first$sel.last$selection isn't in widget %s
                                                                            • API String ID: 1114863663-3133999650
                                                                            • Opcode ID: 8686a149979b04358285c7d14ce34b1eaf1e265ca1ac7779f224653eee490f72
                                                                            • Instruction ID: 3b617667d103a6b238179e4373505fe7be0874b781066ec91ed4f216516a4380
                                                                            • Opcode Fuzzy Hash: 8686a149979b04358285c7d14ce34b1eaf1e265ca1ac7779f224653eee490f72
                                                                            • Instruction Fuzzy Hash: C57157B6B0AA46A6EB108F26D4842693BE0FB48FC5F044475CB0E87758DF3CE595C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B2D40 Relevance: 30.2, APIs: 4, Strings: 16, Instructions: 154stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: INDEX$LOOKUP$SCROLL_UNITS$TCL$VALUE$WRONGARGS$bad argument "%s": must be units or pages$moveto$moveto fraction$option$pages$scroll$scroll number units|pages$units$unknown option "%s": must be moveto or scroll$wrong # args: should be "%s %s %s"
                                                                            • API String ID: 1114863663-2051856877
                                                                            • Opcode ID: 9c377002b2da94674e9bc63862fd666e06ed4a04d42c994cdfc316eea655bd73
                                                                            • Instruction ID: 1d94f3aa0c6686dd3713462d946ceccec8c1d4f6b8ce88cc6c18f3c0978145d7
                                                                            • Opcode Fuzzy Hash: 9c377002b2da94674e9bc63862fd666e06ed4a04d42c994cdfc316eea655bd73
                                                                            • Instruction Fuzzy Hash: DD717365B0AB4AE5EB609F26E8482B93361FB44BD6F080072DE5E47364DF7CE545C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8802140 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 313windowstringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Icon$Destroy$FileInfo$CreateIndirectmemsetstrcmp
                                                                            • String ID: -default$H$ICONBITMAP$OPTION$Tk_SizeOfBitmap received unknown bitmap argument$illegal option "%s" must be "-default"$window ?-default? ?image?
                                                                            • API String ID: 1970194709-3871694194
                                                                            • Opcode ID: 06c05112fa7b51c0b8bd7d28971a4807f75fa7141d48dd696db7384a6a54b2f6
                                                                            • Instruction ID: dd6208dee7c25a38d885da4bff70de5adbd2800ddee8884650c95818091c6291
                                                                            • Opcode Fuzzy Hash: 06c05112fa7b51c0b8bd7d28971a4807f75fa7141d48dd696db7384a6a54b2f6
                                                                            • Instruction Fuzzy Hash: E2E17C76B0AB8696EB658F22E4443A973A1FB88BC5F084435CE4D07754EFBCE454C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8898150 Relevance: 24.4, APIs: 1, Strings: 15, Instructions: 370COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • memset.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF8A889803D), ref: 00007FF8A88981F5
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset
                                                                            • String ID: CheckNodeConsistency: bad child count (%d)$CheckNodeConsistency: duplicated node tag: %s$CheckNodeConsistency: found unpruned root for "%s"$CheckNodeConsistency: level mismatch (%d %d)$CheckNodeConsistency: line doesn't point to parent$CheckNodeConsistency: line ended with wrong type$CheckNodeConsistency: line has no segments$CheckNodeConsistency: mismatch in numChildren (%d %d)$CheckNodeConsistency: mismatch in numLines (%d %d)$CheckNodeConsistency: mismatch in numPixels (%d %d) for widget (%d)$CheckNodeConsistency: mismatch in toggleCount (%d %d)$CheckNodeConsistency: node doesn't point to parent$CheckNodeConsistency: node tag "%s" not %s$CheckNodeConsistency: wrong segment order for gravity$present in parent summaries
                                                                            • API String ID: 2221118986-1392433252
                                                                            • Opcode ID: f6d2df61c8d8a090dcfb8137589b741c96710023d8fef709655c2914319c4c51
                                                                            • Instruction ID: 77187071536e0ff4181228602c3474fe185c169bdd25e12e3515a97dd2882d8b
                                                                            • Opcode Fuzzy Hash: f6d2df61c8d8a090dcfb8137589b741c96710023d8fef709655c2914319c4c51
                                                                            • Instruction Fuzzy Hash: BAF19B62B0AE47A2EB258F25D4442B937A0FB88BC5F484576CA5D47790EF3CE865C318
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B21B0 Relevance: 24.1, APIs: 4, Strings: 12, Instructions: 116stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: or disabled$, active$, hidden$-default$STATE$VALUE$active$bad %s value "%s": must be normal$disabled$hidden$normal$state
                                                                            • API String ID: 1114863663-2434209007
                                                                            • Opcode ID: d99a752e862e109d55b1f1d01ea3c17e08109cf53f7bc0070b26690a2a7dc742
                                                                            • Instruction ID: 6470a7b54ef42cebc52516f8c0bb9073310473341e101bbc4499bd2fabcf12a6
                                                                            • Opcode Fuzzy Hash: d99a752e862e109d55b1f1d01ea3c17e08109cf53f7bc0070b26690a2a7dc742
                                                                            • Instruction Fuzzy Hash: EE517F21B0AB4BA9EB149F15E84837827A1FB85BE1F484271CD6D473A5DF7CE4448328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87FE220 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 374COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: -encoding$-translation$Error converting to internal format$FORMAT$ICON$Invalid file header$READ$binary$error opening file "%s" for reading: %s$error reading file: %s$error seeking in file: %s
                                                                            • API String ID: 0-1482656021
                                                                            • Opcode ID: 371e343402f841fe62214fdaeb89f45ebee375b445223cedba42b878f4efc454
                                                                            • Instruction ID: 627329e138fffeb553bcc6e52c32ddc98ed33783793022ea79ce25d26b55ec5e
                                                                            • Opcode Fuzzy Hash: 371e343402f841fe62214fdaeb89f45ebee375b445223cedba42b878f4efc454
                                                                            • Instruction Fuzzy Hash: 36F1C276B06A4A92EB649F2AD84857933A1FB84FC2F484536CE4E47360DFBDE444C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87ECD80 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 301threadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentHookThreadWindows
                                                                            • String ID: @$DEFAULT$MSGBOX$VALUE$invalid default button "%s"$option$value for "%s" missing
                                                                            • API String ID: 1904029216-2124897083
                                                                            • Opcode ID: 356ccff2321d48c5e7675c203ea5c3c62090244801ad13398cff72c0abc3541c
                                                                            • Instruction ID: 0c591acea778df048d7555e152a57a7f3ab88617c1c1cce25adbc80380b74c6e
                                                                            • Opcode Fuzzy Hash: 356ccff2321d48c5e7675c203ea5c3c62090244801ad13398cff72c0abc3541c
                                                                            • Instruction Fuzzy Hash: D9E16E76B0AB4AA2EB14CB16E8443AA7BA1FB89BC5F444036CE5D43764EF7CE444C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F03A0 Relevance: 21.1, APIs: 14, Instructions: 96windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Object$Select$ModePalette$DeleteRealizeRectangleReleaseStock
                                                                            • String ID:
                                                                            • API String ID: 1878710763-0
                                                                            • Opcode ID: 8dbf6acc142f02e4d46dc1d202c766a2a95ffcefb8b50ca726ad1db67307434e
                                                                            • Instruction ID: 275d662d128fe2920e2c537fbb4bb2c11d0ef33f90e23197130f06ff09b5706f
                                                                            • Opcode Fuzzy Hash: 8dbf6acc142f02e4d46dc1d202c766a2a95ffcefb8b50ca726ad1db67307434e
                                                                            • Instruction Fuzzy Hash: D5314D39B4A6819BDB54DF12B85426AA361FB89FD2F044031DE8B47718EF3CE4868718
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8806D90 Relevance: 18.2, APIs: 12, Instructions: 156COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CapsDevice$Release
                                                                            • String ID:
                                                                            • API String ID: 1035833867-0
                                                                            • Opcode ID: 0841967fcd35f873e79a77b3cbb164721baadaa938bfc9920de34708df44bce2
                                                                            • Instruction ID: cf4ef241b32d2771cf2c9f8e1e604866fb68b8a3fcd24d1c573bde12a83b135b
                                                                            • Opcode Fuzzy Hash: 0841967fcd35f873e79a77b3cbb164721baadaa938bfc9920de34708df44bce2
                                                                            • Instruction Fuzzy Hash: 1871F07AA05B05C7EB58CF26D4842293BA0FB88F99F104066CE0D47758EF7ED445CB54
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8824150 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 105COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: BitsClientRectRelease
                                                                            • String ID: StippleFill$%d %d $($XGetGeometry: invalid pixmap$XGetGeometry: invalid window$XGetGeometry: unable to get bitmap size
                                                                            • API String ID: 3715867303-1272586390
                                                                            • Opcode ID: 8eaf091e3083c04494e393a0d7073d4c8ea5f631ea88cad53b654b39d851bda7
                                                                            • Instruction ID: 7f5cdeafdf363abe7c574e54cc04a73a12dacb8fb6bbb09c61416aa784a1249f
                                                                            • Opcode Fuzzy Hash: 8eaf091e3083c04494e393a0d7073d4c8ea5f631ea88cad53b654b39d851bda7
                                                                            • Instruction Fuzzy Hash: A341A032B0AA46A6EB20DF16E44436A77A1FB88BD5F404036DE9D47B54EF3CE444CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A881ED20 Relevance: 16.6, APIs: 4, Strings: 7, Instructions: 80stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: ARROW$CANVAS$bad arrow spec "%s": must be none, first, last, or both$both$first$last$none
                                                                            • API String ID: 1114863663-518292991
                                                                            • Opcode ID: 94dfd442a184f291b21906d3ef0148fcad3dc0b75280c0c5b510569dd7006d8b
                                                                            • Instruction ID: 672190ba91590b816f030f6ba25e411d057a6efc5f6f697b25111ab49258ca12
                                                                            • Opcode Fuzzy Hash: 94dfd442a184f291b21906d3ef0148fcad3dc0b75280c0c5b510569dd7006d8b
                                                                            • Instruction Fuzzy Hash: 5231D275F0E642A6EB209F19E4803B963A1FB05BD5F884071CAAC03285EF3CE085C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A886C2D0 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 356COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset
                                                                            • String ID: -menu$MENU$Menu$No more menus can be allocated.$SYSTEM_RESOURCES$normal$pathName ?-option value ...?
                                                                            • API String ID: 2221118986-2269277396
                                                                            • Opcode ID: b7ce5e745eb199a496cc385f7cdcea3bc7d52637896a5f28bb66574e57e45c0e
                                                                            • Instruction ID: 144f6a140256f1e5d7b1aaaef8dcf8935b4be4c7bb961b884f5bd30b8262cf26
                                                                            • Opcode Fuzzy Hash: b7ce5e745eb199a496cc385f7cdcea3bc7d52637896a5f28bb66574e57e45c0e
                                                                            • Instruction Fuzzy Hash: 9A028836B0AB8692DB108F26E8442AA73A2FB88FC4F448036CE5D43764DF7CE444C354
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A884CBF0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 250COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Cursor$Capture$LoadRelease
                                                                            • String ID: GRAB$GRABBED$grab failed: another application has grab
                                                                            • API String ID: 209116553-3878467564
                                                                            • Opcode ID: 590c1c728f349329b05ded9f14728796c6dbdaca55f2efd740ca584ef3efbde9
                                                                            • Instruction ID: 1f48dbb8b4f73f499182e26a8f2f0c3e52463a8aaa3a6d5689a716692a85be90
                                                                            • Opcode Fuzzy Hash: 590c1c728f349329b05ded9f14728796c6dbdaca55f2efd740ca584ef3efbde9
                                                                            • Instruction Fuzzy Hash: 61C17932B0AA42A6EB60CF15E4443B977A5FB88BC5F084076CA4E43794EF3CE444C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8836C60 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 197COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: _stricmp_strnicmp
                                                                            • String ID: COLOR$LOOKUP$VALUE$invalid color name "%s"$system$unknown color name "%s"
                                                                            • API String ID: 4098154984-1350147216
                                                                            • Opcode ID: 6fc75bd8bb7453cd85545c476aac7ef31de25a6f463faa97da63f6666f130766
                                                                            • Instruction ID: 6ec691d13671b0e40f9d2df90675b0ff2770e8397be22d6df6c5dc086b472834
                                                                            • Opcode Fuzzy Hash: 6fc75bd8bb7453cd85545c476aac7ef31de25a6f463faa97da63f6666f130766
                                                                            • Instruction Fuzzy Hash: F491AB72B0AA81A6DB50CF15E4443A973A1FB88BD9F484176DE4D473A8DF3CE444C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87FCB30 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 190COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CallProcWindow
                                                                            • String ID: (scrollbar command)$ScrollbarProc called on an invalid HWND$moveto$pages$scroll$units
                                                                            • API String ID: 2714655100-2948507982
                                                                            • Opcode ID: 3627fdd6183671aed720f68ce8f2394935fb6ebbde061c6333592c1f14c098e2
                                                                            • Instruction ID: b6a86e7a8c8e3d423f1cc7af276615b631c72ccea53937be669870fb573f261f
                                                                            • Opcode Fuzzy Hash: 3627fdd6183671aed720f68ce8f2394935fb6ebbde061c6333592c1f14c098e2
                                                                            • Instruction Fuzzy Hash: CA91E532F0BA5AE2EB648B2AE4442B923A1FF85BC1F444036D94D47764DFBCE805C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8822250 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 143stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strtod$_hypotstrncmp
                                                                            • String ID: CANVAS$ITEM_INDEX$POLY$bad index "%s"$end
                                                                            • API String ID: 2305060144-259481206
                                                                            • Opcode ID: 49d81675fb5d2d1acbb343dab5daa674cb0d009c10a67208ff4b1f4484fa0f7b
                                                                            • Instruction ID: 3e8b6ebf8281a20f9a54e28d927ba6b6af060da27d321aa025f3f3c02791adff
                                                                            • Opcode Fuzzy Hash: 49d81675fb5d2d1acbb343dab5daa674cb0d009c10a67208ff4b1f4484fa0f7b
                                                                            • Instruction Fuzzy Hash: 4651A232B09B86A6E7218F25D4442B9B7A0FF49BC6F484272DA9D53324EF3CE451C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8806BC0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 78registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CloseOpenQueryValueVersionmemset
                                                                            • String ID: Control Panel\Appearance$Current$Windows NT is the only supported platform$Windows Standard
                                                                            • API String ID: 4230551253-4106789390
                                                                            • Opcode ID: 32895b9195ccff5c3f303fae0a74719c3b72cf119b0fa215543f19509577a4dd
                                                                            • Instruction ID: f33928490d91049ef9f998c9e22e5c2beabce9e0e7c8107f8f22866f7891a487
                                                                            • Opcode Fuzzy Hash: 32895b9195ccff5c3f303fae0a74719c3b72cf119b0fa215543f19509577a4dd
                                                                            • Instruction Fuzzy Hash: 55419D31B0AA82A2FB60CB10E4653BA7370FB947D5F800175E58E066A5EF7DD644CB28
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88649C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 225COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            • Fail to create pixmap with Tk_GetPixmap in TkImgPhotoInstanceSetSize, xrefs: 00007FF8A8864A84
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset$memcpy$DeleteObject
                                                                            • String ID: Fail to create pixmap with Tk_GetPixmap in TkImgPhotoInstanceSetSize
                                                                            • API String ID: 3824102683-276313315
                                                                            • Opcode ID: b63371a3974e5790847c7156195dee857825e7c6cb05e8d587078910129faf76
                                                                            • Instruction ID: d60d893d7061a247a9f4a8f55ce91c5214dc6384d55af2a6afffdbf89a1f976b
                                                                            • Opcode Fuzzy Hash: b63371a3974e5790847c7156195dee857825e7c6cb05e8d587078910129faf76
                                                                            • Instruction Fuzzy Hash: 87A19832B06A559BDB28CF29D48067D77A2FB88F85F044036DA4D83B58EF38E951CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A880A17B Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 136stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmpstrtol
                                                                            • String ID: "%s" option requires an additional argument$ARG$INTEGER$MISSING$expected %s argument for "%s" but got "%s"$integer
                                                                            • API String ID: 826613874-1598512142
                                                                            • Opcode ID: a2b2a7b6f7671c465d1a6d6639496c966a8cd84874760436435625afa9999ee2
                                                                            • Instruction ID: eeb7d8c72cbb984980f6ca11592e6207031756cc7f873180d3c877ea4009a659
                                                                            • Opcode Fuzzy Hash: a2b2a7b6f7671c465d1a6d6639496c966a8cd84874760436435625afa9999ee2
                                                                            • Instruction Fuzzy Hash: 5A51AC36B0AA8AA5EB608F11E44037A67B1FB45BD4F1441B2CE8E47794CF3DE845C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A880A229 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 135stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmpstrtod
                                                                            • String ID: "%s" option requires an additional argument$ARG$FLOAT$MISSING$expected %s argument for "%s" but got "%s"$floating-point
                                                                            • API String ID: 1067362368-3606263203
                                                                            • Opcode ID: da745f38b7a707d78ef3e84eda1aeadbc97934386a7cbe5b8d3ae1777da9543d
                                                                            • Instruction ID: 815a0c2464c428e547a50324bd3d72a373cb322fa597c4a560be757a9711645a
                                                                            • Opcode Fuzzy Hash: da745f38b7a707d78ef3e84eda1aeadbc97934386a7cbe5b8d3ae1777da9543d
                                                                            • Instruction Fuzzy Hash: 71519D36B0AA8AA5EB618F11E44437A6771FB81BD5F1441B2CE8E07794CF7CE845C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F6C40 Relevance: 13.7, APIs: 9, Instructions: 156keyboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Virtual$Unicodememset$ScanState
                                                                            • String ID:
                                                                            • API String ID: 988457538-0
                                                                            • Opcode ID: 84393eed155a1d4e998c1026bfed084c0454a11fbd3677f47a6cee7c557f1de7
                                                                            • Instruction ID: e307dfce814c391a2fe0146bd1d2f7a369b70ce30e37cd827a844efd1c428269
                                                                            • Opcode Fuzzy Hash: 84393eed155a1d4e998c1026bfed084c0454a11fbd3677f47a6cee7c557f1de7
                                                                            • Instruction Fuzzy Hash: 0851F333B1E69697EB148B16D40077DB7A1FB85394F44003AEAC943A95CFBDD844CB28
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A882EAF0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 408COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: CreateMessage$BitmapDeleteErrorFormatFreeLastLocalObjectReleaseSection
                                                                            • String ID: "$CANVAS$GC already registered in Tk_GetGC$SCROLL_REGION$bad scrollRegion "%s"$called GCInit after GCCleanup
                                                                            • API String ID: 1892380217-3500747879
                                                                            • Opcode ID: ebf5d239fb9526e590d53c5eff58cf12263069587b1797727dd29c3a963d2e4e
                                                                            • Instruction ID: 97b4a7afe268c8e2f94c7dd4fc9354006652e232784e5cf10989f2c2ff8f7064
                                                                            • Opcode Fuzzy Hash: ebf5d239fb9526e590d53c5eff58cf12263069587b1797727dd29c3a963d2e4e
                                                                            • Instruction Fuzzy Hash: 572266B2B06B8696EB24CF26D4442AD37B5FB48B89F04403ACE5D57758EF38E454CB24
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B4DF0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: isupper
                                                                            • String ID: EXISTS$NOTCLASS$VALUE$WINDOW$window name "%s" already exists in parent$window name starts with an upper-case letter: "%s"
                                                                            • API String ID: 2794029478-341583549
                                                                            • Opcode ID: ae96a09ecfebf1da6ad02de605c90d2547529d6523c05bd4fe38a26e604e449f
                                                                            • Instruction ID: 4a340983f72ef7e9b6a6055714189f361702103fc93b6ebf3fbae8bac6d462f4
                                                                            • Opcode Fuzzy Hash: ae96a09ecfebf1da6ad02de605c90d2547529d6523c05bd4fe38a26e604e449f
                                                                            • Instruction Fuzzy Hash: CB619862A0AA8AA9EB608F11E4483AD77A0FB89FD4F484172DA4E07794DF3CE555C314
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B82E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeRealizeSelect$DrawEdgeRelease
                                                                            • String ID: relief
                                                                            • API String ID: 3185835912-743904975
                                                                            • Opcode ID: 018d0e69be4d552159b25c28cad2c871a38fbae3777208883ce1cc68b3ce98f6
                                                                            • Instruction ID: 6b7c6c3efc7bfe9550d037bebf22995b92d37dfdad31848e02c70ae0fba32ca0
                                                                            • Opcode Fuzzy Hash: 018d0e69be4d552159b25c28cad2c871a38fbae3777208883ce1cc68b3ce98f6
                                                                            • Instruction Fuzzy Hash: 3E416F76B09A8597EB108F16E8402AEB361FB89BD1F045136DE8E83724EF7CE554CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8858A50 Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 234COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memcpy
                                                                            • String ID: EARLY_END$EOF$IMAGE$PNG$channel read failed: %s$unexpected end of file$unexpected end of image data
                                                                            • API String ID: 3510742995-1708351035
                                                                            • Opcode ID: e900513a6ba54378526181cad5fe62014979accb64d4367502036b18d0465187
                                                                            • Instruction ID: aee86ab322da13dcdccb43c7e3a84b36ed9776acca367d3489d91c338f841d0b
                                                                            • Opcode Fuzzy Hash: e900513a6ba54378526181cad5fe62014979accb64d4367502036b18d0465187
                                                                            • Instruction Fuzzy Hash: A4B12162B0EA46A2EB248F26E0043BA37A1FB44BC9F085172CE5D07794DF3DE555C768
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88DC260 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 129COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset
                                                                            • String ID: #$Cannot delete root item$ROOT$TREE$TTK$TreeviewSelect$items
                                                                            • API String ID: 2221118986-2347191746
                                                                            • Opcode ID: ac985a4505e215af362b413412c9706f2e9612bf3e8bdab5d4b46c00ce5d0398
                                                                            • Instruction ID: 94f63b9e251cccba31ff842edfe71174f8ee1394421a78e4dc1c4689eb9b2052
                                                                            • Opcode Fuzzy Hash: ac985a4505e215af362b413412c9706f2e9612bf3e8bdab5d4b46c00ce5d0398
                                                                            • Instruction Fuzzy Hash: 65519D32B0AB8AA2EB58CF12E5442A977A1FB48BC4F084436DE4D03B95DF3CE155CB54
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88401E0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 229COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: fabs$memcmp
                                                                            • String ID: (in command executed by spinbox)$%lf$down
                                                                            • API String ID: 1615362767-1224525252
                                                                            • Opcode ID: 59115fefa3801d695f09124e39428a807d6ce21d1893035c4a8ad0825cbc2618
                                                                            • Instruction ID: 62e3eafaaf3aaae791a04103f81d1631f15903489309cc218987e1b087a8a871
                                                                            • Opcode Fuzzy Hash: 59115fefa3801d695f09124e39428a807d6ce21d1893035c4a8ad0825cbc2618
                                                                            • Instruction Fuzzy Hash: A2C17D33F0AA8AA6EBA18F26E4442AB67A0FB85BC5F044272DE4D17754DF7DD440C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A888C19F Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 156stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: ": should be "-command"$-command$?-command command?$TkBTreeLinesTo couldn't find line$TkBTreeLinesTo couldn't find node$wrong option "
                                                                            • API String ID: 1114863663-3890656830
                                                                            • Opcode ID: b900f7b05ad5210b99a5d3cdb2658f2e0fa37fa4633eaef7498d274e93d9dccb
                                                                            • Instruction ID: 03b23bc3d7e27aaa7e221394ef2c8d21fed6db9a789c7f3b5eb37b3170480003
                                                                            • Opcode Fuzzy Hash: b900f7b05ad5210b99a5d3cdb2658f2e0fa37fa4633eaef7498d274e93d9dccb
                                                                            • Instruction Fuzzy Hash: BE715C33B0AA46A2EAA48F16D44867977A6FB48FC1F094572CE5D07394DF7CE841C318
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8842C60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 115COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: printf
                                                                            • String ID: focus cleared after %s died$forwarding focus to %s after %s died$releasing focus to root after %s died
                                                                            • API String ID: 3524737521-3504952018
                                                                            • Opcode ID: 5b77c721d35a8e73efb03b34dd82d0d620dc0845c01fda2badd547b428425409
                                                                            • Instruction ID: 7e46fbf00f53c4bb7594f5ca8f3d69e8e5f6e67d2bb1976b11498cc358282893
                                                                            • Opcode Fuzzy Hash: 5b77c721d35a8e73efb03b34dd82d0d620dc0845c01fda2badd547b428425409
                                                                            • Instruction Fuzzy Hash: 40515A7770AA8692DB648F22E8403A973A4FB44BC4F048475CB8D47B55CF78E461C728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A884C2C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 108stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: isspace$strtod
                                                                            • String ID: SCREEN_DISTANCE$VALUE$bad screen distance "%s"
                                                                            • API String ID: 442120894-2282610269
                                                                            • Opcode ID: 9495994279ba4917b6d4dd0e07003bc3447a1617f70808260d903e01cd9a60b2
                                                                            • Instruction ID: 61b6040bc5f69367bfc10e39116a30079ee01957258eddd5d8f12bd06ded2684
                                                                            • Opcode Fuzzy Hash: 9495994279ba4917b6d4dd0e07003bc3447a1617f70808260d903e01cd9a60b2
                                                                            • Instruction Fuzzy Hash: 86419032B0DB86A5EB518F21A41427AB3A6FF45BC1F084172DA8E13355DF3CE046D728
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8828B60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: LOOKUP$SMOOTH$ambiguous smooth method "%s"$bezier$smoothMethod
                                                                            • API String ID: 1114863663-1216440562
                                                                            • Opcode ID: 0e19764866daa2702ed14f13722d941757b3c121b2be37f1c9f151b50428c1c2
                                                                            • Instruction ID: 6bf529017b3d280162762aa94e717f986e41ef7b514a3a0ccfa40403214048e8
                                                                            • Opcode Fuzzy Hash: 0e19764866daa2702ed14f13722d941757b3c121b2be37f1c9f151b50428c1c2
                                                                            • Instruction Fuzzy Hash: 1841B372B0AB86A1EF509F21E8002AA73A4FB44BD5F484076DE9D47754EF3CE4A5C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F01A0 Relevance: 10.6, APIs: 7, Instructions: 66windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ModePalette$DeleteObjectRealizeReleaseSelect
                                                                            • String ID:
                                                                            • API String ID: 3511821735-0
                                                                            • Opcode ID: f80c6d0f795ba0db20a48360770214d91aa4960974bd77614f0a25f3ec61d352
                                                                            • Instruction ID: e613de30586d2ad0f8d58494775dca9f5b8e2ec20f32012f5afcede4e07125bd
                                                                            • Opcode Fuzzy Hash: f80c6d0f795ba0db20a48360770214d91aa4960974bd77614f0a25f3ec61d352
                                                                            • Instruction Fuzzy Hash: BB212839B09A4597EA10DB12A44006EB3A1FB89FC1F544135EE8D87B19DF3CE5928B18
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8800D46 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 64windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend
                                                                            • String ID: WITHDRAW$can't withdraw %s: it is an icon for %s$can't withdraw %s: the container does not support the request$window
                                                                            • API String ID: 3850602802-424501824
                                                                            • Opcode ID: 79a46f53ba4360cf16e6e2b74b14b2f4ba767769c70bf59951814a704449ab67
                                                                            • Instruction ID: 69eac9d37a84f1663195d34283e0ca75838220f8ad661afb1497eb00913baf69
                                                                            • Opcode Fuzzy Hash: 79a46f53ba4360cf16e6e2b74b14b2f4ba767769c70bf59951814a704449ab67
                                                                            • Instruction Fuzzy Hash: 23216532B16A86E2EB51CF22D4446B92360FB44BD9F480072DE0E4B354DF7CE885C724
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A882C9EF Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 185stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: CANVAS_ITEM_TYPE$LOOKUP$coords ?arg ...?$type coords ?arg ...?$unknown or ambiguous item type "%s"
                                                                            • API String ID: 1114863663-1447066070
                                                                            • Opcode ID: 0cda0bfedab92142da0f90a7e60c2344bed200ace4742f9410701e5b37c69d26
                                                                            • Instruction ID: 27743d2b6ed00fc4ba962d88158fe2949726c27f231597ccbb1531ae05211b7e
                                                                            • Opcode Fuzzy Hash: 0cda0bfedab92142da0f90a7e60c2344bed200ace4742f9410701e5b37c69d26
                                                                            • Instruction Fuzzy Hash: 5C916B36B0AB86A2EB149B22D8442B937A5FB48BD6F450576CE6E03760DF7CD054C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8854D80 Relevance: 9.1, APIs: 6, Instructions: 111COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF8A8854953), ref: 00007FF8A8854DB3
                                                                            • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF8A8854953), ref: 00007FF8A8854DD4
                                                                            • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF8A8854953), ref: 00007FF8A8854E04
                                                                            • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF8A8854953), ref: 00007FF8A8854E46
                                                                            • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF8A8854953), ref: 00007FF8A8854E88
                                                                            • isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF8A8854953), ref: 00007FF8A8854ED8
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: isspace
                                                                            • String ID:
                                                                            • API String ID: 3785662208-0
                                                                            • Opcode ID: a52b3de9db36492d73d92d51d524ef7efeae0a6603d8c3f4fc7d85198b106175
                                                                            • Instruction ID: f1f7a95af21b98794c2b92a60e4eb59469958073c86bae950ae0b0630be1304d
                                                                            • Opcode Fuzzy Hash: a52b3de9db36492d73d92d51d524ef7efeae0a6603d8c3f4fc7d85198b106175
                                                                            • Instruction Fuzzy Hash: A6412661B4A682A2EB684F26D08033837A0FB41FE1F1851B2DB9D036D5DF2DD9D18324
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B8120 Relevance: 9.1, APIs: 6, Instructions: 106windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeRealizeSelect$ControlDeleteDrawFrameRelease
                                                                            • String ID:
                                                                            • API String ID: 697344041-0
                                                                            • Opcode ID: 88fa53974e2a1f5d8df53d5410196d480c9e72efd3a146044edc78066c213289
                                                                            • Instruction ID: ffdcc44b106dd3bae23a75ec12c52527535c0dce57842e609ed04b5a9adee2ab
                                                                            • Opcode Fuzzy Hash: 88fa53974e2a1f5d8df53d5410196d480c9e72efd3a146044edc78066c213289
                                                                            • Instruction Fuzzy Hash: 33411436B19A849AEB208F25E44096EB361FBD9BC5F149231EE8E57714EF3CE5418B40
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B8A90 Relevance: 9.1, APIs: 6, Instructions: 86windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeRealizeSelect$DeleteDrawFocusRectRelease
                                                                            • String ID:
                                                                            • API String ID: 3871974525-0
                                                                            • Opcode ID: fcd740503da37f46fc30cb85a02c9fd5c60acea4150deef6258b165ca1ff1cc1
                                                                            • Instruction ID: b194ba30cb8a02daa067c12d761e124e672297cc80301925143ed5395d54009f
                                                                            • Opcode Fuzzy Hash: fcd740503da37f46fc30cb85a02c9fd5c60acea4150deef6258b165ca1ff1cc1
                                                                            • Instruction Fuzzy Hash: A0317F66A1D78996DB50DB26E4451AEB360FBD9BC1F106035EE8E43B18EF3CD090CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8836111 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 75stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00007FF8A8836980: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FF8A8834E94), ref: 00007FF8A88369D9
                                                                            • strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A883617C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strcmpstrncmp
                                                                            • String ID: ?-displayof window? id$?bad atom?$ATOM$LOOKUP$no atom exists with id "%s"
                                                                            • API String ID: 1845225520-257443217
                                                                            • Opcode ID: d229fe0f3a28ebbfd728ff2158f8baebfdae1687cdf1e38a8750ac75db051474
                                                                            • Instruction ID: 676838a0d385132cf48a9a3b48741a4bc3b43d0029ebf57f8ae714274fb48638
                                                                            • Opcode Fuzzy Hash: d229fe0f3a28ebbfd728ff2158f8baebfdae1687cdf1e38a8750ac75db051474
                                                                            • Instruction Fuzzy Hash: 46317C36B0AB86A2E711DB65D4042BE2360FB88BD5F444572CE1E47754DF3CE145C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B8980 Relevance: 9.1, APIs: 6, Instructions: 62windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeRealizeSelect$DeleteDrawFocusRectRelease
                                                                            • String ID:
                                                                            • API String ID: 3871974525-0
                                                                            • Opcode ID: f43bf408c37900591f2e6dd64fda01551cb76a281adbabe9b90cdcb63e339691
                                                                            • Instruction ID: f86c8808a774e8841357346fa91bf574209d44be0fcaab17c5937d319d1cde8c
                                                                            • Opcode Fuzzy Hash: f43bf408c37900591f2e6dd64fda01551cb76a281adbabe9b90cdcb63e339691
                                                                            • Instruction Fuzzy Hash: 8E217176B19B8596EB20CB12E94416DB361FB89BC5F446235DE8E43718EF3CE1908B04
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F02B0 Relevance: 9.1, APIs: 6, Instructions: 58windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeObjectRealizeReleaseSelectStock
                                                                            • String ID:
                                                                            • API String ID: 391112280-0
                                                                            • Opcode ID: 9f0951966c437faaeb4b6da458d5fffdcd6badca49e5b04c4017837087824bca
                                                                            • Instruction ID: eb2ae80805a59e390a7d2c31cbd8917272671a099507464718a5da25afb69423
                                                                            • Opcode Fuzzy Hash: 9f0951966c437faaeb4b6da458d5fffdcd6badca49e5b04c4017837087824bca
                                                                            • Instruction Fuzzy Hash: B121393AB0DB4597DA109B12A58427EB362FB8ABC0F144135DE8D47B59DF2CE8818B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8844200 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 307COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: ObjectStock
                                                                            • String ID: FONT$INTERNAL_PROBLEM$ansifixed$failed to allocate font due to internal system font engine problem
                                                                            • API String ID: 3428563643-2695973982
                                                                            • Opcode ID: 740b4c84dc3499b69681c6705e843b9cc960c095c419a442d46a79d5e6df7d57
                                                                            • Instruction ID: fa50ace96488798749b517e17074d207051df22cb24409e6f0bb45355efccff2
                                                                            • Opcode Fuzzy Hash: 740b4c84dc3499b69681c6705e843b9cc960c095c419a442d46a79d5e6df7d57
                                                                            • Instruction Fuzzy Hash: 83D15576B0AB46A6EB648F26E44466973A4FB48FC5F088176CE4E43B50EF3CE450C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8848170 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 257COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: atof$atoi
                                                                            • String ID: iso8859-1$normal
                                                                            • API String ID: 342931922-3590427085
                                                                            • Opcode ID: c5000f3a449495d1afa9df6d7edaa1c779416878a6c956d965fdbd99775ab2c3
                                                                            • Instruction ID: 18c174fabf89c8cde0385b27efba8558e9d918b14520fa905baa8cf70dcd2d74
                                                                            • Opcode Fuzzy Hash: c5000f3a449495d1afa9df6d7edaa1c779416878a6c956d965fdbd99775ab2c3
                                                                            • Instruction Fuzzy Hash: D6B12523B09BC695EB248F25D4403B937A1FB5ABC5F488172DA9D02795EF3CE591C328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F6970 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: FormatFreeLocalMessagewcsrchrwsprintf
                                                                            • String ID: Error Code: %08lX
                                                                            • API String ID: 538048751-205266100
                                                                            • Opcode ID: 773b637c9c1c5d21f0a621054a92f3f89f1c864bb21040c370978465a133e1bf
                                                                            • Instruction ID: 48e97eeb52fe16ff7682e5f455935f0ac4365964e541e20974ff9eb629af993d
                                                                            • Opcode Fuzzy Hash: 773b637c9c1c5d21f0a621054a92f3f89f1c864bb21040c370978465a133e1bf
                                                                            • Instruction Fuzzy Hash: A0317E36B09B8592DB218B51F4502AAB3B1FBC8BD1F444136DA9D03B98DFBCD505CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88DCCC0 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 190COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memset
                                                                            • String ID: #$?add|remove|set|toggle items?$TreeviewSelect$selection operation
                                                                            • API String ID: 2221118986-3040475516
                                                                            • Opcode ID: 461478c05d44aa205cfa1dfe7cb5f9a3f948ed4d89831700ec94aa52a65f7266
                                                                            • Instruction ID: 58a956dccb4a155d47bd8f2f071d7bef897ab9b87ff4f24992069d8af2122018
                                                                            • Opcode Fuzzy Hash: 461478c05d44aa205cfa1dfe7cb5f9a3f948ed4d89831700ec94aa52a65f7266
                                                                            • Instruction Fuzzy Hash: 11914C72B0AB4695EB648F26D4443B977A1FB88FC0F184575CA0D83B94DF38E450CB68
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88862DB Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 107stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: activate element$arrow1$arrow2$slider
                                                                            • API String ID: 1114863663-1361700830
                                                                            • Opcode ID: e9886723d497e6ed868c5044ca501d20ba1565bcbd9b1d8a7372345d0810fc1e
                                                                            • Instruction ID: b6602ada3509e2eef024d7b83f8ae8b7a9e7a077b7be0c00c47fb61d62984357
                                                                            • Opcode Fuzzy Hash: e9886723d497e6ed868c5044ca501d20ba1565bcbd9b1d8a7372345d0810fc1e
                                                                            • Instruction Fuzzy Hash: E25181B1B4AA86A2EB68CB22D4583BD37A1FB41BC1F484175CA5E07790CF3CE5549324
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E4A80 Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeRealizeSelect$Release
                                                                            • String ID:
                                                                            • API String ID: 4052958442-0
                                                                            • Opcode ID: 8336bacaa9944d7a7674e165133fa120a74d13be9d5ed11c290d11bbd86bc30e
                                                                            • Instruction ID: 678a713a4b3790f2a98d9ac8157dbf3414ba16224b2a12b37fd7d2a0f53eb1f8
                                                                            • Opcode Fuzzy Hash: 8336bacaa9944d7a7674e165133fa120a74d13be9d5ed11c290d11bbd86bc30e
                                                                            • Instruction Fuzzy Hash: 9641A236B1D6919BD7208F16A40027AB761FB88BD4F148535EE8E43758EF3CE880CB48
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8836980 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 64stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FF8A8834E94), ref: 00007FF8A88369D9
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: -displayof$DISPLAYOF$NO_VALUE$value for "-displayof" missing
                                                                            • API String ID: 1114863663-1107398220
                                                                            • Opcode ID: 8c9a25e2735053c057f014a4ee18a0dde9a3ece51d7e715e146d688b9a08f968
                                                                            • Instruction ID: 4f4383ed0d20b291a057fbdef0d39f9f2b84d5648f228a03b09a66f223176e06
                                                                            • Opcode Fuzzy Hash: 8c9a25e2735053c057f014a4ee18a0dde9a3ece51d7e715e146d688b9a08f968
                                                                            • Instruction Fuzzy Hash: D521D331B0AB46A1EB10DB1AE84826A6372FB89BD2F184036CE5D837A4EF7DD401C314
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A889EA20 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Rect$CreateDeleteObject$CombineIndirectRegion
                                                                            • String ID:
                                                                            • API String ID: 3685044251-0
                                                                            • Opcode ID: 94535b6d7df8e665b879aedda765ae63afcc48f9ed969fa963f4c6dc486c1e07
                                                                            • Instruction ID: 147130b24a0b4ae9fe40a9443041372ef942d68ff67e79e940250061b46a3192
                                                                            • Opcode Fuzzy Hash: 94535b6d7df8e665b879aedda765ae63afcc48f9ed969fa963f4c6dc486c1e07
                                                                            • Instruction Fuzzy Hash: 1911E126B16B8197EA20DB22EC44ABA7760FB88FD2F458031DD8E43710EF3CE0418714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8836962 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 57stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FF8A8834E94), ref: 00007FF8A88369D9
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: -displayof$DISPLAYOF$NO_VALUE$value for "-displayof" missing
                                                                            • API String ID: 1114863663-1107398220
                                                                            • Opcode ID: dd286131cbf9e86886eb1c1cabe9382d85e6f6bcf45c4df3790931b633383905
                                                                            • Instruction ID: f667e172ee6e4c496d33fddc7ff1e22a1b1db34f8d28bb5e91551b723edfffb0
                                                                            • Opcode Fuzzy Hash: dd286131cbf9e86886eb1c1cabe9382d85e6f6bcf45c4df3790931b633383905
                                                                            • Instruction Fuzzy Hash: 2721C476B0AA82A2D7108F15E88426A7732FB89BD6F488036CE4D47769EF7DD045C714
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B83D4 Relevance: 7.5, APIs: 5, Instructions: 31windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$DeleteDrawEdgeModeRealizeReleaseSelect
                                                                            • String ID:
                                                                            • API String ID: 1417962085-0
                                                                            • Opcode ID: 3f09bddcf07580c74b7eb0234aa48d433581e64c76b48c67905d01a68568ae7e
                                                                            • Instruction ID: 9926697fe9b425c4654e687bf0370982dba92a8008940fb369f82a891b38540c
                                                                            • Opcode Fuzzy Hash: 3f09bddcf07580c74b7eb0234aa48d433581e64c76b48c67905d01a68568ae7e
                                                                            • Instruction Fuzzy Hash: 2DF04F2AB0964293EA209F12F85467E6321FBC5BE2F045071CD8B47754DF3CE0458B14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87F41D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: DeleteObject
                                                                            • String ID: unicode$utf-16
                                                                            • API String ID: 1531683806-3317161374
                                                                            • Opcode ID: f479ba5b30d86aa3ffa71a3c03f8286c72157bb17c9a8685f6b70a284ed0c9a5
                                                                            • Instruction ID: 527c5c993f93e2c090247ab80738b2ce8601c06594f897eb45a0a70920346d29
                                                                            • Opcode Fuzzy Hash: f479ba5b30d86aa3ffa71a3c03f8286c72157bb17c9a8685f6b70a284ed0c9a5
                                                                            • Instruction Fuzzy Hash: AA41FB36B1BA5AA2EB548B17D54413963A1FF88BC5F088436CA5E03764DFBDE861C314
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A88B8DA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MetricsSystem
                                                                            • String ID: orientation
                                                                            • API String ID: 4116985748-914408790
                                                                            • Opcode ID: 51ebc509d51ec129fe9c4cee379852935c97c122500949818b519dc2a37c31fb
                                                                            • Instruction ID: 573093f41c48a08424037a0a25e6ca4cf6844a644d0d74445b22f71253e8caa0
                                                                            • Opcode Fuzzy Hash: 51ebc509d51ec129fe9c4cee379852935c97c122500949818b519dc2a37c31fb
                                                                            • Instruction Fuzzy Hash: 0D017C75A0AB89D7E7104F21E44426977A0FB88BC1F44003AD68E03B64DF3CC454CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E4AF8 Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeRealizeReleaseSelect
                                                                            • String ID:
                                                                            • API String ID: 878934721-0
                                                                            • Opcode ID: 4ac453b6dfa54a3d69ae6e1daf731f3f851a39312a7dfa9003470df0e14c8d3b
                                                                            • Instruction ID: 3fa1830df5e560ae0f1f5d28294611d99348df313afd5c934438579076cac51c
                                                                            • Opcode Fuzzy Hash: 4ac453b6dfa54a3d69ae6e1daf731f3f851a39312a7dfa9003470df0e14c8d3b
                                                                            • Instruction Fuzzy Hash: B92151367196958BD724CF1AE04462E7761FB88BD4F148521DE8E43768EF3CE881CB58
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E4B0C Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$ModeRealizeReleaseSelect
                                                                            • String ID:
                                                                            • API String ID: 878934721-0
                                                                            • Opcode ID: 09a761b403e5297f368eaa5c905483bedfcce3834f44042ed326f2f7e137be84
                                                                            • Instruction ID: f5cd611a94f5174941d0d5e6f8049aa6be4b8d4e273b2ad18a6e0a15f37445bf
                                                                            • Opcode Fuzzy Hash: 09a761b403e5297f368eaa5c905483bedfcce3834f44042ed326f2f7e137be84
                                                                            • Instruction Fuzzy Hash: CF215136B196958BD724CF1AE04462E7761FB88BD4F148521DE8E43768EF3CE881CB58
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8856A00 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF8A8855D3D), ref: 00007FF8A8856A59
                                                                            • strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF8A8855D3D), ref: 00007FF8A8856A75
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: GIF87a$GIF89a
                                                                            • API String ID: 1114863663-2918331024
                                                                            • Opcode ID: 49b6de37fcaa32286c1e4ef7ce685f7e9a49d3935c792d0391dd4e3f717f92ae
                                                                            • Instruction ID: c8061ff3c2d32dd38f6b3f656f03e92ff125c0282219382f592bd336e62771d2
                                                                            • Opcode Fuzzy Hash: 49b6de37fcaa32286c1e4ef7ce685f7e9a49d3935c792d0391dd4e3f717f92ae
                                                                            • Instruction Fuzzy Hash: 76213471B2D682A1FB64CB12E84057A7BA1EB847C0F04A031FA8E87B58EF3CD545CB14
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E4B2F Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$DeleteModeRealizeReleaseSelect
                                                                            • String ID:
                                                                            • API String ID: 306815563-0
                                                                            • Opcode ID: 567e4705a7ecc40e7012704c38f4990e1b4f6d9c6ae75183c3239212846cab92
                                                                            • Instruction ID: c2a15dad2f880f2ef8aa30cd2e7bb13edd3b1bf80bbad2da397378883d061af2
                                                                            • Opcode Fuzzy Hash: 567e4705a7ecc40e7012704c38f4990e1b4f6d9c6ae75183c3239212846cab92
                                                                            • Instruction Fuzzy Hash: B021813671D6958BD720CF16E00466E7761FB88BD4F148521DE8A43769EF3CE881CB08
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87E4B3F Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$DeleteModeRealizeReleaseSelect
                                                                            • String ID:
                                                                            • API String ID: 306815563-0
                                                                            • Opcode ID: 53abd98dfdd8c8775870644d9f24b58088fffb65545a3662eaccb54acc178954
                                                                            • Instruction ID: 8081266c151690a80bfbe59c750bad2a2f597ca64290f30471095010414eb0de
                                                                            • Opcode Fuzzy Hash: 53abd98dfdd8c8775870644d9f24b58088fffb65545a3662eaccb54acc178954
                                                                            • Instruction Fuzzy Hash: 3321813671D6958BD720CF16E00466E7761FB88BD4F148521DE8A43769EF3CE881CB08
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8856900 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 57stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: GIF87a$GIF89a
                                                                            • API String ID: 1114863663-2918331024
                                                                            • Opcode ID: e9dccb956e286ad6d3c42c6c4bac353f9817c0b8cc23d1b5f43fc16d6c42ce40
                                                                            • Instruction ID: 8c5a41e14a9606e2865b41d5df8957e2842c40eda22944e5f0fc70bd516a0e55
                                                                            • Opcode Fuzzy Hash: e9dccb956e286ad6d3c42c6c4bac353f9817c0b8cc23d1b5f43fc16d6c42ce40
                                                                            • Instruction Fuzzy Hash: 4821D376B097819AD760CF16E44079AB7A1F788BC0F548135EA8C83B18DF3DE984CB54
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8822DA0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 37stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: USAGE$can't specify both -file and -channel$monochrome
                                                                            • API String ID: 1114863663-3063129647
                                                                            • Opcode ID: 3c173284c9adb181a01ad91b966202299db9a9fc90c46e05b3d62934d7722938
                                                                            • Instruction ID: b708e00b179d5abeae6085aaccaad444928b417517da0b12ae97d4e1e6485b2d
                                                                            • Opcode Fuzzy Hash: 3c173284c9adb181a01ad91b966202299db9a9fc90c46e05b3d62934d7722938
                                                                            • Instruction Fuzzy Hash: 3A018E35F0A616A5FB518B6594543B867A0EB48BE6F180335D93E422E4EF7CE0848328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87EEC00 Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: Palette$DeleteModeRealizeSelect
                                                                            • String ID:
                                                                            • API String ID: 4235896006-0
                                                                            • Opcode ID: 611794a7a062c66783fe9fb1f7eea5246391ab836f1a27848840bcd5dcb31063
                                                                            • Instruction ID: 155982e43e40eeed25afc42a1ed49b3c575ae90cf85548a8d67135dd3c0bbe8b
                                                                            • Opcode Fuzzy Hash: 611794a7a062c66783fe9fb1f7eea5246391ab836f1a27848840bcd5dcb31063
                                                                            • Instruction Fuzzy Hash: F9011D3AB19A81D3EB548B12F68003E6321FB89FD1F049071EE9A47B68DF3CD4828704
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8822D99 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 34stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: USAGE$can't specify both -file and -channel$monochrome
                                                                            • API String ID: 1114863663-3063129647
                                                                            • Opcode ID: 54df1512fe66aa0f7b3d6aaef2b45d451636ac1cd2cd4edf6d18a1deede614a0
                                                                            • Instruction ID: 3e710a56f19eb6d345093ecb8e325b41198080a2db2ad0310305c809de201976
                                                                            • Opcode Fuzzy Hash: 54df1512fe66aa0f7b3d6aaef2b45d451636ac1cd2cd4edf6d18a1deede614a0
                                                                            • Instruction Fuzzy Hash: 4F01AD31F0A616A5FB518B6194543B867A0EB08BFAF180335D93F422E4EF7CD0808328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8822DAC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 32stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: strncmp
                                                                            • String ID: USAGE$can't specify both -file and -channel$monochrome
                                                                            • API String ID: 1114863663-3063129647
                                                                            • Opcode ID: 1734006e987507df9124e09df79d40f94a228672ec103dee250e7f0c7738f69c
                                                                            • Instruction ID: a6742f34b45a0cda7a5aa994bb591154513f87d5f78216e3c6902eb62cb70076
                                                                            • Opcode Fuzzy Hash: 1734006e987507df9124e09df79d40f94a228672ec103dee250e7f0c7738f69c
                                                                            • Instruction Fuzzy Hash: AA014C35F0AA16A5FB518B6594543A867B0EB48BFAF180335DD3E522E4EF7CD4848328
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8804AC0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: MetricsSystem
                                                                            • String ID:
                                                                            • API String ID: 4116985748-0
                                                                            • Opcode ID: 7e3483952597167de68bf9b5338a8a6e2862c78601633ddb6a571209eec93a46
                                                                            • Instruction ID: d7123534b0939cbc0934a748b484fcac08420c27158841c1f151b5a269278c84
                                                                            • Opcode Fuzzy Hash: 7e3483952597167de68bf9b5338a8a6e2862c78601633ddb6a571209eec93a46
                                                                            • Instruction Fuzzy Hash: 72F0347AA0978683E7044F62F88422D7761FB99FC1F449870DB8A07B58DF3CC8918B08
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A884AB00 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 261COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: DeleteObject
                                                                            • String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup
                                                                            • API String ID: 1531683806-2292843906
                                                                            • Opcode ID: d6af84e848fbc81eef8e987f84af7b749f5bed4d7f90f628a2ccc5bab520a8a5
                                                                            • Instruction ID: d1848f5aa6f6a8221ef4f8b3fe916564551fd848826bbe7920d396a2e653cc4d
                                                                            • Opcode Fuzzy Hash: d6af84e848fbc81eef8e987f84af7b749f5bed4d7f90f628a2ccc5bab520a8a5
                                                                            • Instruction Fuzzy Hash: 68C12777B0A606AEE760CF64D0446AD37A1FB08B88F414476DE0E5B788DF38E485C768
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A87EE9F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: DialogWindow
                                                                            • String ID: ::tk::fontchooser
                                                                            • API String ID: 2634769047-3115935596
                                                                            • Opcode ID: 2dbe9e301def9e0e0260a382d335bd695aed60ea4682e00237b6031b10b069f9
                                                                            • Instruction ID: c34b18ee2321f188a318ce8618e4f65531b5408fbd01735562edc95a26eef8a0
                                                                            • Opcode Fuzzy Hash: 2dbe9e301def9e0e0260a382d335bd695aed60ea4682e00237b6031b10b069f9
                                                                            • Instruction Fuzzy Hash: 53E06DA6B1660292EB249F62D884A3913A2EF8CFC2F485434C90D46350EF6CD481C224
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%

                                                                            Function 00007FF8A8850D60 Relevance: 5.1, APIs: 4, Instructions: 110COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.3302816713.00007FF8A87E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8A87E0000, based on PE: true
                                                                            • Associated: 00000002.00000002.3302789767.00007FF8A87E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302907156.00007FF8A88E1000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302955221.00007FF8A8928000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3302989585.00007FF8A8929000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303022362.00007FF8A892D000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303051960.00007FF8A892E000.00000008.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303082555.00007FF8A8930000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                            • Associated: 00000002.00000002.3303113074.00007FF8A8932000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_7ff8a87e0000_QuackMod.jbxd
                                                                            Similarity
                                                                            • API ID: memcpymemset
                                                                            • String ID:
                                                                            • API String ID: 1297977491-0
                                                                            • Opcode ID: 4d129376527b45afda0faaca6445f1f11ca3b5333ecd8dd5522dc43151c3ba93
                                                                            • Instruction ID: c69f41d939845fcfbb49e99bca47598ce9553a72ee4783bb34ef351af41f250e
                                                                            • Opcode Fuzzy Hash: 4d129376527b45afda0faaca6445f1f11ca3b5333ecd8dd5522dc43151c3ba93
                                                                            • Instruction Fuzzy Hash: B241C8B6B06B8986CB648F56E88402E7BAAFB8CFC0B151026DF4D03755CF38D4418B04
                                                                            Uniqueness

                                                                            Uniqueness Score: -1.00%